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DEFENSE CONTRACT AUDIT AGENCY: WHO IS 
RESPONSIBLE FOR REFORM? 


WEDNESDAY, SEPTEMBER 23, 2009 

U.S. Senate, 

Committee on Homeland Security 
AND Governmental Aefairs, 

Washington, DC. 

The Committee met, pursuant to notice, at 10:04 a.m., in room 
SD-342, Dirksen Senate Office Building, Hon. Joseph I. 
Lieberman, Chairman of the Committee, presiding. 

Present: Senators Lieberman, McCaskill, Burris, Collins, and 
Coburn. 

OPENING STATEMENT OF CHAIRMAN LIEBERMAN 

Chairman Lieberman. The hearing will come to order. Good 
morning to all who are here. Welcome to this hearing where we are 
going to examine the potential that billions of taxpayer dollars are 
at risk of being wasted because of the inadequate auditing proce- 
dures at the Defense Contract Audit Agency (DCAA). 

DCAA has 300 offices and 3,800 auditors throughout the United 
States and the world. Just to give you a sense of the scope of their 
responsibilities, in fiscal year 2008, which is the last one obviously 
for which I have complete data, DCAA did more than 30,000 audits 
covering $501 billion in proposed or claimed contracts. That is a lot 
of audits with a lot of money, and therefore, what it does or does 
not do well is of great consequence to the taxpayers. 

A year ago, our Committee heard from the Government Account- 
ability Office (GAO) and two auditors, whistleblowers, if you will, 
from DCAA about alarming problems in the Western Region of 
DCAA. We heard and then found that there was widespread failure 
in meeting professional auditing standards in that region. Time 
after time, DCAA had issued clean audits of contractors that were 
simply not supported by the underlying audit work. In some cases, 
supervisors had even overturned the audit findings of subordinates 
without a justification for their decisions. 

Because Senator Collins and I were concerned that these prob- 
lems in the Western Region might be symptoms of a larger sys- 
temic breakdown rather than just a regional one, we, joined by 
Senator McCaskill, asked the GAO to do a review across all the re- 
gions of DCAA, and today we are going to hear the results of that 
review. 1 


^The GAO report referenced by Chairman Lieberman appears in the Appendix on page 134. 

( 1 ) 
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I am sorry to say that GAO has found similar problems just 
about everywhere DCAA operates. I will just highlight some of the 
findings because I know Mr. Kutz will speak to them in detail. 

Each and every audit that GAO reviewed for this report was out 
of compliance with auditing standards, most with very serious defi- 
ciencies. As an example, in one case, a supervisor directed audit 
staff to delete some audit documents, generate others, and copy the 
signature of a prior supervisor onto the new documents and then 
issued a clean audit opinion. This supervisor was later promoted to 
Western Region Quality Assurance Manager, responsible for the 
quality control of thousands of audits. 

One auditor asked supervisors for permission to spend more time 
on an audit of a contractor known to be under criminal investiga- 
tion for fraud. The auditor ultimately drafted a negative opinion 
that was overturned by supervisors who then, rather than praise 
the auditor’s efforts, lowered his performance appraisal for per- 
forming too much testing and exceeding budgeted hours. 

In an audit of one of the Department of Defense’s (DOD) largest 
contractors, the auditor told GAO that he did not perform detailed 
tests “because the contractor would not appreciate it.” 

When auditors reviewed contractor invoices, in many cases, they 
did not look to see if the contractor could offer supporting docu- 
mentation for the goods or services they were charging the govern- 
ment for. The auditors simply looked at the numbers on the in- 
voices to see if they added up. 

To date, GAO’s two reviews have led DCAA itself to rescind 80 
of its audits, which is, I gather, a rare and, of course, embarrassing 
step for an auditing agency. The recision of 80 audits is, to me, ef- 
fectively a self-indictment by DCAA for failure to hold audit quality 
above all else. 

Now, this would be bad enough if it was a separate and unique 
critical audit by GAO, but the fact is that this is the fifth major 
report sounding the alarm about DCAA. In addition to the two 
GAO audit reports that I have cited, we have a 2007 Department 
of Defense Inspector General (IG) peer review, a report last fall 
from the Defense Business Council, and a new DOD IG report, all 
showing that an important watchdog agency, DCAA, is badly in 
need of overhaul. 

The fact is, when the people we have charged with the responsi- 
bility of auditing themselves receive this many critical audits — 
Washington, we have got a problem — and it is a big problem be- 
cause of the enormous amount of money being audited that is 
spent — over half-a-trillion dollars in 2008 through the Defense De- 
partment. 

In my opinion, DCAA is in need of a complete overhaul. One 
problem may be, as GAO suggests, that DCAA emphasizes speed 
and production of audits over the quality of results. DCAA also ap- 
pears to be very insular, with little or no infusion of skills from out- 
side the agency. 

I think it is really time for us to make sure that we change this 
environment with specific steps, such as improving audit quality 
control, increasing training of the auditors, and developing a strat- 
egy to target resources rather than simply churning out audits that 
are faulty to hit numerical goals. 
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So we want to have a very frank discussion today because this 
is very important. A lot of money is on the line, and the discussion 
really is about who is responsible in the end for the operational re- 
form that is necessary at DCAA. 

This auditing agency has a unique role. Because of that role, it 
also needs to have independence. It needs to stand up to pressures 
from both agencies and contractors, and as I believe may be sug- 
gested here today, perhaps that independence should be strength- 
ened. Perhaps it is time for us to consider separating DCAA from 
the Department of Defense and, either separately or as part of a 
larger operation, making it an independent auditing agency. 

But what is also needed right now is clearly strong leadership 
from the top ranks of DOD to help DCAA achieve the necessary 
transformation and reforms because this Committee, Senator Col- 
lins and I and the Members, do not want to be sitting here a year 
from now discussing another audit which finds similar problems 
once again in DCAA. Let us identify the root causes and implement 
the solutions that Congress must demand and that the taxpayers 
surely deserve. 

Senator Collins. 

OPENING STATEMENT OF SENATOR COLLINS 

Senator Collins. Thank you, Mr. Chairman. 

With the release of today’s GAO report, we once again focus on 
the extensive problems with the quality of audits at the Defense 
Contract Audit Agency and with the management of this watchdog 
agency. 

The DCAA is the Defense Department’s principal contract audi- 
tor. It completes more than 30,000 reviews and audits per year 
that cover hundreds of billions of dollars in Federal contracts. A 
well-functioning DCAA is thus vital to our government’s responsi- 
bility to be careful stewards of taxpayer funds. DCAA plays a nec- 
essary role in ensuring the accountability and transparency of Fed- 
eral contracts. 

Unfortunately, the GAO report contains a haunting refrain of 
disturbing past reports. It cites, for example, and perhaps most 
troubling, a lack of independence from undue influence on audit 
outcomes by contractors, program managers, and even some senior 
managers at DCAA. It cites poor or inadequate audit quality and 
gross mismanagement of government resources. And it cites inef- 
fective audit practices that allow contractors to overbill the govern- 
ment in some cases for millions of dollars. 

The Department of Defense and other Federal agencies rely on 
DCAA to help detect waste, fraud, and abuse. It is, therefore, com- 
pletely unacceptable for this Federal policing agency to continue to 
have such significant performance problems. 

With more than a little frustration, I note that we are here al- 
most 1 year to the day since the Committee’s last hearing on this 
very same topic, DCAA’s poor performance. During the 2008 hear- 
ing, I raised significant concerns, as did the Chairman, about the 
mismanagement of DCAA, and yet here we are again. 

Three particularly troubling areas still need to be addressed. 
First, the GAO report highlights the ongoing lack of rigor and inde- 
pendence of DCAA audits due to coercion by a few errant contrac- 
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tors, program managers, and on occasion, even by DCAA manage- 
ment. Auditors cannot be constrained from doing their jobs. They 
must be able to work in an environment where they are encour- 
aged to conduct their oversight in a fair, unbiased, and principled 
manner — indeed, not just encouraged, required to conduct their au- 
dits in that manner. 

Now, I want to make clear that there are many principled, dedi- 
cated, and competent auditors at DCAA who endeavor to conduct 
themselves with the highest possible ethical and professional 
standards. The management and the culture at DCAA must sup- 
port their efforts, not undermine them. 

Second, I am baffled by the complete lack of a sense of urgency 
in terms of addressing and resolving these problems. As the Chair- 
man has indicated, there have been repeated reports indicating 
these flaws. Recent reviews of DCAA’s reform efforts do not assure 
me that significant progress has been made over the past year. 
While DCAA has taken some steps toward improvement, it has 
been too little. 

To date, DCAA, as the Chairman has indicated, has rescinded 
some poor quality audits and issued guidance to improve the qual- 
ity. The agency also plans to hire 700 additional auditors to aug- 
ment its workforce. But if all we do is add more people, that is not 
going to solve the fundamental failings of this agency. Indeed, the 
consequences of not requiring high-quality audits and of mis- 
management may only multiply with these additional resources. 
Just throwing more people at the problem is not going to solve it. 

Less than a month ago, the DOD Inspector General completed an 
investigation that found evidence of this kind of mismanagement. 
It cited time pressure, uncompensated overtime, unauthorized 
changes to audit results, and other unprofessional behavior that 
had created a work environment not conducive to performing qual- 
ity audits. What will it take to finally see progress? DCAA’s inabil- 
ity to remedy its mismanagement, despite numerous hearings, in- 
vestigations, and report after report, is truly an epic failure by the 
agency and the Department. 

Third, the GAO report raises significant questions regarding the 
need for structural reforms, such as the Chairman has mentioned 
and I brought up last year. How can it be that DCAA auditors 
spent more than 530 hours auditing a billing system that did not 
exist? How can it be that they repeatedly change audit findings to 
make the results acceptable to some contractors? 

To make matters worse, I am told that some supervisors respon- 
sible for deficient audits were given performance ratings ranging 
from “exceeds fully successful” to “outstanding.” Again, how can 
this be? Where is the accountability? 

Now, let me end by saying why this is so important. When an 
audit agency fails, the fallout can cascade throughout the system 
and ultimately shortchange our troops in the field. For this reason 
alone. Congress must carefully consider whether fundamental re- 
structuring as well as internal reforms are needed at DCAA in 
light of these disclosures. 

Reestablishing DCAA as a first-rate audit agency is critical, and 
I will say that to date, I have been very disappointed at the lack 
of leadership at DCAA itself and at the Office of the Comptroller, 
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which is responsible for overseeing and supporting DCAA. Action 
must he taken swiftly to help this agency regain its credibility and 
restore its oversight mission. Once its performance and image have 
been repaired, it can once again assume its vital role of ensuring 
the best value for the American taxpayer on all defense contracts. 
Thank you, Mr. Chairman. 

Chairman LlEBERMAN. Thank you very much. Senator Collins. 
Before I call on Mr. Kutz, I want to say that I mentioned. Sen- 
ator McCaskill, that you had joined us in the request for this report 
by GAO, and I appreciate that, and it leads me to moving slightly 
behind you and acknowledging the work of your Counsel, Peg Gus- 
tafson, who as you know has been nominated by the President to 
be the Inspector General of the Small Business Administration. I 
want to thank her for the hard work she has done on the matter 
before us today and so many other issues, and we look forward to 
working with you as you move on into the IG community. Your 
nomination is pending before our Committee now. We will give it 
a rigorous and dispassionate review, of course, and hope to dis- 
charge your nomination by unanimous consent as soon as possible. 
Good luck. 

Senator McCaskill. Mr. Chairman, can we slow that down any? 
[Laughter.] 

I am having buyer’s remorse 

Chairman LlEBERMAN. I understand. 

Senator McCaskill [continuing]. About losing Ms. Gustafson. 
[Laughter.] 

Chairman LlEBERMAN. We have a conflict of interest here, but we 
will help you resolve it. 

Mr. Kutz, you are here for the second day in a row. God only 

knows what may bring us together tomorrow [Laughter.] 

But I thank you for your continuing high level of work, which 
greatly benefits Congress and ultimately the people of our country. 
I would note that you are here with Gayle Fischer, who is an As- 
sistant Director at GAO who will be available to answer questions. 

For the record, Mr. Kutz is before us as Managing Director of the 
Forensic Audits and Special Investigations Team of GAO. Thanks 
for your work, and we welcome your testimony now. 

TESTIMONY OF GREGORY D. KUTZ,i MANAGING DIRECTOR, 
FORENSIC AUDITS AND SPECIAL INVESTIGATIONS, U.S. GOV- 
ERNMENT ACCOUNTABILITY OFFICE, ACCOMPANIED BY 
GAYLE L. FISCHER, ASSISTANT DIRECTOR, FINANCIAL MAN- 
AGEMENT AND ASSURANCE, U.S. GOVERNMENT ACCOUNT- 
ABILITY OFFICE 

Mr. Kutz. Mr. Chairman and Members of the Committee, thank 
you for the opportunity to discuss the Defense Contract Audit 
Agency. Last year, I testified that 14 audits at three California lo- 
cations did not meet professional standards. Today’s testimony 
highlights our broader review of the DCAA quality control system. 

My testimony has two parts. First, I will discuss our findings, 
and second, I will discuss our recommendations. 


^The prepared statement of Mr. Kutz and Ms. Fischer appears in the Appendix on page 37. 
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First, 65 of the 69 engagements that we reviewed did not meet 
professional standards. Key issues relate to lack of independence, 
insufficient testing, and inadequate planning and supervision. Ex- 
amples of these problems include, first, an accounting system re- 
port drafted with eight significant deficiencies. One year after con- 
tractor objections to this draft report, an adequate or clean opinion 
was issued with no deficiencies. We found little evidence to support 
these changes. 

Second, an adequate opinion issued on a billing system with in- 
sufficient testing. As you mentioned, in this case, Mr. Chairman, 
an auditor told us that testing was limited because the contractor 
would not appreciate it. 

Third, an adequate opinion issued for a billing system based on 
a test of only four vouchers, all from the same day. 

And finally, as Senator Collins mentioned, 530 hours spent audit- 
ing a billing system that did not exist. 

Further evidence of problems at DCAA is the recision of 80 audit 
reports. I expect that the recision of 80 audit reports is unprece- 
dented in both the Federal Government and the private sector. The 
evidence supporting our conclusion of widespread audit quality 
problems is irrefutable. 

So why did these problems happen? Let me give you a few of the 
examples. First, we found a production-focused culture resulting in 
part from flawed metrics. These metrics focused on getting audits 
done on time and within budget. Taking time to find and address 
issues was discouraged. This resulted in some audits of accounting 
and billing systems being issued within 2 to 3 weeks of the en- 
trance conference. No wonder we saw opinions of contractor sys- 
tems being issued based upon a conversation with the contractor 
and a quick look at a few transactions. 

Further evidence of the need to cut corners is the 22,000 reports 
issued in 2008 by DCAA’s 3,600 auditors. That is 60 reports issued 
every day of the year, including weekends and holidays. There is 
also evidence of pressure caused by the fear of DCAA being 
outsourced. In other words, DCAA’s metrics were intended to show 
that they could do their work faster and cheaper than public ac- 
counting firms. 

Let me move on to human capital. Last year, the original whis- 
tleblower, Thi Le, testified before this Committee on her experience 
at DCAA. Ms. Le’s testimony is one of the most memorable of my 
experience. If this GS-12 auditor and the dozens of others that we 
have spoken to are representative of DCAA’s employees, then the 
quality of audit staff is not the issue. Instead, what you have are 
thousands of good auditors trapped in a broken system. 

Let me move on to steps that can be taken to improve DCAA’s 
operations. First, let me commend this Committee for your over- 
sight on this matter. The hearing you held last year and your con- 
sistent oversight have made a difference. DOD is taking these mat- 
ters very seriously. Positive steps have been taken and are under- 
way to address most of these issues. My only recommendation to 
you is to continue your oversight. 

We made 15 recommendations to the Secretary of Defense. The 
intent of these recommendations was to strengthen DCAA’s inde- 
pendence and effectiveness. DOD agreed with 13 of these rec- 
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ommendations. We also provided three matters for the Congress to 
consider, as you had requested. 

The first of these relates to providing DCAA with the protections 
and authorities granted to Inspectors General. Legislation would be 
needed to implement this matter. This change could strengthen 
leadership, independence, and transparency through external re- 
porting of DCAA results to the Congress. 

The other two matters relate to organizational placement. Most 
of the effectiveness issues can be addressed within the current or- 
ganization placement. However, elevating DCAA to a separate 
DOD component or outside of DOD as an independent audit agency 
are matters for longer-term consideration. We believe that organi- 
zational placement changes should not be considered until current 
reform efforts are complete. 

In conclusion, the 14 audits that we reported on last year were 
not isolated cases but, in fact, proved to be the tip of the iceberg. 
We commend DOD for their recent actions. However, it is impor- 
tant to remember that if not for a tip from a courageous GS-12 
auditor. Congress would still believe that everything at DCAA was 
fine. We look forward to working with this Committee and DOD to 
help DCAA achieve its full potential. 

Mr. Chairman, this ends my statement, and I look forward to 
your questions. 

Chairman LlEBERMAN. Well done. Thank you very much. 

Next, we are going to hear from the Hon. Gordon Heddell, who 
is the Inspector General for the Department of Defense. 

TESTIMONY OF HON. GORDON S. HEDDELL, i INSPECTOR 
GENERAL, U.S. DEPARTMENT OF DEFENSE 

Mr. Heddell. Chairman Lieberman, Ranking Member Collins, 
and distinguished Members of this Committee, thank you for the 
opportunity to be here today to discuss continuing oversight by my 
office of audits conducted by the Defense Contract Audit Agency. 

The Department of Defense Office of the Inspector General has 
the responsibility to verify that audits by all DOD audit agencies, 
including DCAA, comply with stringent standards. At the hearing 
last year before this Committee, we discussed serious problems 
with DCAA, to include weaknesses in its quality assurance pro- 
grams, audits that failed to comply with generally accepted govern- 
ment auditing standards, and allegations of an abusive work envi- 
ronment. We have been monitoring DCAA’s efforts to correct the 
deficiencies identified in our May 2007 peer review and in a report 
issued in July 2008 by the Government Accountability Office. 

On August 31 of this year, we issued a report following up on the 
deficiencies identified by GAO. We found that a flawed audit could 
have allowed a contractor to recover millions of dollars in unallow- 
able costs on a major aerospace pro^am. We found audits per- 
formed by trainee auditors at one location that did not comply with 
standards. We found audit opinions that were not sufficiently sup- 
ported. And we found audit findings that were dropped without 
sufficient justification. Additionally, employee concerns with time 
pressures, uncompensated overtime, changes to audits, and unpro- 


^The prepared statement of Mr. Heddell appears in the Appendix on page 56. 
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fessional behavior created a work environment not conducive to 
producing quality audits. 

We made several recommendations to DCAA, including that it 
rescind an additional five audit reports and notify contracting offi- 
cials not to place reliance on the reports’ conclusions. Our report 
also recommended that DCAA take appropriate corrective action 
regarding the performance of the two supervisors associated with 
the majority of cases reviewed by my office and GAO. DCAA re- 
ported that those individuals will retake supervisory courses and 
receive additional training. We expect DCAA to monitor their per- 
formance very carefully. 

We issued a report on September 11 of this year regarding im- 
proper conduct by a DCAA manager. This senior official investiga- 
tion supported a GAO finding that a former regional audit manager 
was not free from external impairments to independence. Her di- 
rection resulted in a flawed audit that could have allowed a con- 
tractor to recover $271 million in unallowable costs. Additionally, 
we concluded that the individual failed to adhere to established 
leadership standards and fell short of the type of leadership skills 
expected from senior leaders. The report was provided to the Direc- 
tor of DCAA for appropriate action. 

Based on the most recent GAO review of DCAA, together with 
the deficiencies identified in our May 2007 peer review, I notified 
DCAA that our adequate opinion on its system of quality controls 
would expire as of August 26 of this year. Further, that DCAA 
should qualify its audits with a statement noting an exception to 
compliance with the quality control and assurance standard. 

On August 5 of this year, we announced the peer review for the 
period ending September 30, 2009. This review will assess whether 
DCAA’s quality control system provides reasonable assurances of 
compliance with standards. We will also follow up on DCAA correc- 
tive actions in response to prior GAO and DOD IG recommenda- 
tions, including the findings in our May 2007 and December 2003 
peer review reports. 

On September 1 of this year, DCAA requested that GAO approve 
delaying the announced peer review by at least 2 years so that it 
could continue internal improvements. The DOD Inspector General 
has a statutory responsibility to provide continuous audit over- 
sight, and should the peer review be postponed, we will undertake 
a number of targeted reviews of DCAA high-risk areas. 

Our oversight is essential to helping DCAA identify audit defi- 
ciencies and to take corrective actions. However, implementing 
change and creating a quality workforce requires a commitment by 
management. It is essential that DCAA’s senior management ad- 
dress fundamental issues, to include recruiting, training, and culti- 
vating skilled personnel, and most importantly, developing highly 
skilled and motivated leaders. Equally important is the engage- 
ment, involvement, and support of senior DOD management. Ab- 
sent any of these factors, DCAA will fail to achieve the cultural 
transition necessary for success. 

This concludes my statement. I welcome your questions. 

Chairman LlEBERMAN. Thank you very much. 

Next, we will hear from the Hon. Robert Hale, Under Secretary 
of Defense, Comptroller, and Chief Financial Officer of the Depart- 
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ment of Defense, to whom, if I have this straight, the DCAA re- 
ports, correct, Mr. Hale? 

Mr. Hale. Yes. 

Chairman LlEBERMAN. Thanks for being here. 

TESTIMONY OF HON. ROBERT F. HALE,i UNDER SECRETARY 

OF DEFENSE (COMPTROLLER) AND CHIEF FINANCIAL OFFI- 
CER, U.S. DEPARTMENT OF DEFENSE 

Mr. Hale. Mr. Chairman, Members of the Committee, thank you 
for the opportunity to share some observations about the Defense 
Contract Audit Agency. I will focus on the concerns raised by the 
recent audits of DCAA, particularly by the GAO audit. 

As Members of the Committee are aware, the Department has 
submitted a lengthy response to GAO’s recommendations. We ac- 
knowledge the seriousness of GAO’s findings as well as those of the 
IG and others and concur with their recommendations with very 
few exceptions. I will mention a couple below. 

Based on my own review of DCAA and the GAO recommenda- 
tions, as well as the IG, I believe that DCAA, with assistance from 
me and others in the Department of Defense, needs to focus on 
three major issues. First, maybe foremost, improving the quality of 
audits, especially the audits of contractor business systems. Sec- 
ond, assessing the number and types of audits performed by DCAA 
and whether all audits currently required by acquisition laws and 
regulations are appropriate. I am worried about 24,000 audits a 
year, as the GAO pointed out. We have to be sure we do all that 
are needed, but we also need to look at that number. And finally, 
assessing improvements in the process for resolving DCAA audit 
results to ensure that audit findings are fully considered during 
contracting officer deliberations. 

DCAA has already begun to focus on these major issues and on 
others. As GAO said, a number of steps have been taken, and in 
her testimony, the DCAA Director, April Stephenson, will describe 
some of the actions that have already been completed and those 
that are underway. 

It is important to note that the audit assignments covered by 
GAO and the IG were completed 3 to 5 years ago, and all of the 
audits that we are talking about cover items completed 3 to 5 years 
ago, and that a series of corrective actions was undertaken begin- 
ning in late 2008, not long after the hearing that you held last 
year. The Committee has to understand that it may take several 
years — it took us several years to get into this problem — for the full 
benefit of these actions to be realized. 

In addition, I would like Members of the Committee to know that 
the Office of the Under Secretary of Defense, Comptroller, my of- 
fice, has taken some steps to improve oversight of DCAA oper- 
ations. First, I have assigned a senior member of my staff to assist 
on oversight efforts. This provides me some personal eyes and ears 
to keep track of what is going on. 

Second, last March, I established a DCAA Oversight Committee 
to provide my office with advice and recommendations concerning 
the oversight of DCAA. The committee is made up of the Auditors 


^The prepared statement of Mr. Hale appears in the Appendix on page 66. 
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General of the Army, Navy, and Air Force — all three of them per- 
sonally agreed to participate — and these individuals provide me 
with some heavyweight audit experience that is simply not present 
on my staff, which is focused on financial management and the 
budgetary responsibilities. 

Also on this oversight committee is — and I think we need to pay 
careful attention to — the Director of Defense Procurement and Ac- 
quisition Policy (DPAP). He is the key customer for DCAA, and we 
want to keep them in mind as we work to improve the agency’s 
performance. The DOD Deputy General Counsel for Acquisition 
and Technology is also a member. 

This senior group will assess DCAA’s activities — they have al- 
ready begun to do so — and the actions taken to correct problems, 
and they have provided me advice. I have met with them several 
times personally and will continue to do so. 

We have also taken steps in the Department of Defense to in- 
crease the resources available to DCAA. During fiscal years 2009 
and 2010, we will add 500 new auditors, and we will consider addi- 
tional auditor positions beyond fiscal year 2010. I will be moni- 
toring the DCAA budget carefully, and that is something I can do 
during our fall program and budget review. 

We believe that by taking aggressive action, improving oversight, 
and increasing resources, we can resolve the significant issues 
posed by the GAO report, as well as the report by the IG, and we 
will monitor that progress, and I will personally, to determine if 
further actions need to be taken. 

While we generally agree with GAO, there are two areas where 
we take exception or disagree with their findings. First, GAO sug- 
gested that Congress consider providing DCAA with independence 
similar to that of the Department’s Inspector General. There are 
some aspects of that suggestion that may make sense. For example, 
we are looking at increased subpoena authority for DCAA. But we 
disagree with the number of the implications of that recommenda- 
tion. 

For example, we do not believe the DCAA Director should be a 
presidential appointment with Senate confirmation. It will inject, 
in my view, an inappropriate element of politics into what should 
be a technical audit agency and inevitably will create long periods 
of delay — it is just inevitable in our system — when there would be 
no Director in charge. 

Likewise, we oppose fixed terms for the DCAA Director and man- 
datory public reporting, as the IG is required to do. It is an addi- 
tional burden on an agency that is already struggling to meet its 
many mission demands. 

While we do not support IG-like independence for most aspects 
of it, we are taking steps to strengthen DCAA’s independence inter- 
nally in a number of ways, but I will mention one in particular, by 
assessing improvements to the process used by contracting officials 
to resolve DCAA audit findings. When there is disagreement, we 
need a process that allows DCAA to elevate that disagreement if 
it cannot be resolved at the staff level, and we have put that in 
place with the Director of Procurement and Acquisition Policy and 
appeals to both the Under Secretary of Acquistion, Technology, and 
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Logistics (AT&L) and the Comptroller if DCAA does not feel that 
the first set of appeals has resolved the issues. 

Second, GAO suggested that Congress require DCAA to report to 
the Deputy Secretary of Defense. DOD strongly disagrees with this 
recommendation. The Deputy Secretary is the Chief Management 
Officer of one of the world’s largest organizations. He backs up the 
Secretary in the wartime chain of command. Direct oversight of an 
individual Defense Department agency would, I believe, add unrea- 
sonably to his current responsibilities. 

I think DCAA should remain within the Department, and at 
least until these issues are resolved, I believe it should continue to 
report to my office. I feel personally responsible for helping to fix 
the problems that have occurred. 

In sum, Mr. Chairman, we acknowledge that GAO has raised 
some serious issues. We believe that we have begun taking appro- 
priate steps — and I think that is important — to resolve these 
issues, and I will personally monitor the situation to determine if 
additional steps are needed. 

Let me close with what I believe is an important and critical con- 
text, and I ask the Committee’s help. DCAA provides valuable serv- 
ices to the Department of Defense and other government organiza- 
tions. You have all said that. I agree. I have spoken personally to 
the Director of Defense Procurement and Acquisition Policy, one of 
DCAA’s key customers. He informed me that DCAA products are 
necessary and critical to the acquisition process. The Commission 
on Wartime Contracting has made similar comments. 

As we strive to resolve the issues raised by GAO and others, I 
am worried about morale at the agency. We have to be careful not 
to undermine the unique value of DCAA to DOD and other organi- 
zations. Let us be careful not to throw out the baby with the 
bathwater here. 

Mr. Chairman, thank you again for providing this opportunity for 
me to comment on GAO’s findings. I am convinced that working to- 
gether with this Committee and the senior leadership of the De- 
partment and, of course, DCAA, we can ensure that the work of 
DCAA will continue to support the Department and the security of 
the United States. 

When the other witnesses have completed their statements, I 
would be glad to answer your questions. 

Chairman LlEBERMAN. Thank you, Mr. Hale. 

And finally, April G. Stephenson, Director of the Defense Con- 
tract Audit Agency. 

TESTIMONY OF APRIL G. STEPHENSON, i DIRECTOR, DEFENSE 
CONTRACT AUDIT AGENCY, U.S. DEPARTMENT OF DEFENSE 

Ms. Stephenson. Mr. Chairman, Members of the Committee, 
thank you for the opportunity to appear before you today. I am 
pleased to be here. 

As requested, I will describe the actions taken as a result of the 
recent oversight reviews of DCAA. Please be assured, we take all 
findings that have taken place on DCAA from any source very seri- 
ously. 


^The prepared statement of Ms. Stephenson appears in the Appendix on page 69. 


VerDate Nov 24 2008 13:37 Apr 18, 201 1 Jkt053841 POOOOOO FrmOOOIS Fmt6633 Sfmt 6633 P:\DOCS\53841.TXT SAFFAIRS PsN: PAT 



12 


We have worked diligently since late 2008 to accomplish a num- 
ber of actions to improve the quality of the audit services and to 
improve the working environment for our employees. As shown in 
the appendix of my submitted testimony, we have completed over 
50 specific improvement actions. We are not done, and we have 
various long-term actions in process. 

For the purposes of my testimony today, Mr. Chairman, we have 
categorized the issues into four general areas: Insufficient testing, 
ineffective quality assurance program, lack of independence, and 
management abuses. 

The GAO identified noncompliances with the audit standards of 
nearly all the assignments it has reviewed. This is primarily due 
to an insufficient number of transactions tested, particularly in as- 
signments of business systems where the contractor’s system was 
deemed to be adequate. 

Contractor internal control systems involve hundreds of control 
points. Auditors assess the risks of the control points on govern- 
ment contracts and establish the level of testing on that risk. At 
times, auditors assess the risk at low and sampled few trans- 
actions, and at other times the risk was high and sampled more 
transactions. In some instances, the number of transactions we re- 
viewed, we have no defense for. It was unacceptable. In others, it 
was a judgment call, and we are in the process of revamping this 
process. 

As I said, we recognize these concerns with the business systems 
and initiated a project in 2009 to reassess the entire process for 
performing audits of business systems and the types of opinions to 
be provided. This will continue into early 2010. We are consulting 
with the GAO and the IG as we proceed with this project. 

The GAO concluded that DCAA’s quality assurance program was 
deficient. We recognize that improvements are required, not only 
with the structure of the quality assurance organization, but also 
the manner in which the reviews were performed. In August 2008, 
we centralized the quality assurance function to headquarters. We 
then proceeded with more than double the reviews we performed 
in the past. We no longer provide a rating of pass-fail depending 
on the number of deficient assignments. Offices that are deter- 
mined to have at least one assignment in noncompliance with the 
auditing standards are required to provide a meaningful corrective 
action plan, which is monitored at the headquarters level. 

The GAO concluded that DCAA’s independence was impaired. 
This was primarily due to providing input on draft corrections to 
internal control policies and procedures and then auditing the final 
policies and procedures. It is not uncommon for contractors with 
system deficiencies to seek input from the auditors while they are 
developing corrections to the systems. In many instances, providing 
feedback throughout the process expedites the correction of the de- 
ficiencies. 

The GAO has concluded that this feedback impairs the auditors’ 
objectivity as they audit information they have provided feedback 
for prior to implementation. We have corrected these issues. Audi- 
tors no longer provide feedback to contractors on draft corrections 
to systems, and we will no longer remove deficiencies from reports 
when the deficiencies are corrected during the audit. 
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In July 2008, the GAO concluded that DCAA had an abusive 
work environment. The IG was engaged to investigate this matter, 
and as Mr. Heddell mentioned, they finished their review in Au- 
gust 2009. Although they did not go as far as to say we had an 
abusive work environment, it concluded that we had a work envi- 
ronment that was not conducive to producing quality audits. Audi- 
tors felt pressure to work uncompensated overtime, and in another 
office, several employees said that they heard people yelling in the 
office and raising their voices. We believe these issues have been 
adequately addressed, and the IG concurs. 

The DOD IG did not identify any attempts by DCAA to impede 
the GAO investigation other than the letter that was written in 
August 2007 to one of our senior auditors, which I know this Com- 
mittee is familiar with. As we discussed at the hearing last Sep- 
tember, the letter was prepared by one of the Defense Legal Serv- 
ices attorneys that reports to DCAA. The letter was rescinded the 
day after the hearing last year. 

To provide employees an opportunity to report instances of per- 
ceived management abuse without fear of retaliation, we launched 
an anonymous Web site in September 2008. The Web site is treated 
as a hotline, and allegations are either investigated by DCAA’s in- 
ternal ombudsman team, which we established in late 2008, or re- 
ferred to the DOD IG for investigation. 

Mr. Chairman, as a result of these oversight reviews, we have 
taken a number of actions. I would like to highlight some of the 
actions I have not previously discussed in a very brief form. 

We completed a bottom-up staffing assessment to determine 
whether we had the appropriate staffing at all levels of the organi- 
zation. We have received funding under the Defense Acquisition 
Workforce Development Fund, as Mr. Hale mentioned. We added 
25 new field audit offices, increasing from 79 offices in August 2008 
to 104 offices in August 2009, to provide greater training to em- 
ployees as well as to ensure appropriate oversight of audit quality. 

The performance measure process was completely revamped. We 
eliminated 18 prior measures and added eight new measures to 
focus on audit quality. Focus groups were held in 2009 and feed- 
back was favorable that most employees reported they did not feel 
pressure to meet the performance measures on individual assign- 
ments. Auditors did feel pressure to meet additional budget hours 
and did not feel they could request an extension. So as a result, we 
removed the requirement to meet budget hours from performance 
standards and inserted new language on the requirement to com- 
plete audits in accordance with the auditing standards. 

We hired the Center for Defense Management Reform at the 
Naval Postgraduate School to assist with cultural transformation 
across the agency. We instituted a revised process for determining 
the audit requirements for 2010. Audit priorities were established 
based on the audits required under laws and regulations, and the 
field offices developed the audit hours that were necessary, taking 
into consideration the risk of the contractors, the skill level of the 
audit staff, and the additional hours required to comply with the 
auditing standards. This process is consistent with the GAO’s rec- 
ommendation of performing a risk-based approach rather than pro- 
duction line auditing. 
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We engaged the Army Force Management Support Agency to 
evaluate DCAA’s process for planning 2010 audit needs as well as 
our staffing requirements. We provided training to all employees on 
quality audits and the work environment. 

In closing, Mr. Chairman, I want to underscore that DCAA is 
committed to ensuring the agency is above reproach, that our au- 
dits are performed in accordance with auditing standards, and that 
its culture promotes the kind of vigilance and quality that protects 
the interests of the American taxpayers. 

Mr. Chairman, thank you again for the opportunity to address 
the Committee. I would be pleased to take your questions. 

Chairman LlEBERMAN. Thank you, Ms. Stephenson. We will now 
go to 7-minute rounds. 

Mr. Kutz, let me begin with you just to draw out a little more 
a couple of the points that were in your findings than you had the 
time to do in your opening statement. One of the findings was, and 
I paraphrase it, you found a lack of independence in DCAA. So I 
wanted to ask you, a lack of independence from whom, the contrac- 
tors, the Department of Defense, perhaps supervisors? What is the 
problem? 

Mr. Kutz. It would be more along the lines of the contractors, 
I would say, with respect to the example I mentioned in the open- 
ing statement, that they did not do additional work because the 
contractor would not appreciate it. That is a disturbing finding, I 
think, that someone would actually believe that was important. 
That would be like us auditing an Executive Branch agency for 
you, and if they said, we would prefer that you do not look at the 
transactions, we would walk away. I mean, that is not the way 
things should work. 

Chairman LlEBERMAN. So they were too cozy or whatever, intimi- 
dated in some sense by some of the contractors, is what you are 
saying. So they were not performing the independent audits that 
we presume auditors will perform. 

Mr. Kutz. That, and there were also certain other issues with re- 
spect to data requests maybe that were made, not filled, and then 
the audit was completed even though the data was not received at 
the end of the day. So things like that 

Chairman LlEBERMAN. Without the auditor insisting on it. 

Mr. Kutz. Or making it a scope restriction and saying, we just 
did not have enough evidence to conclude on the system or what- 
ever was being audited. So those are the kinds of things. And 
again, I believe it was seven — Ms. Fischer, is that correct? 

Ms. Fischer. Right. 

Mr. Kutz. Seven of the audits. So how widespread it is, I do not 
know, but seven of the 69. So there is enough there that it is a bit 
of a concern. 

Chairman LlEBERMAN. Senator Collins cited, and you did, too, 
this case of the auditor spending more than 500 hours auditing a 
billing system that did not exist. How does that happen? 

Mr. Kutz. Well, it was not the contractor in this case. It was a 
grantee, and grantees do not bill. They do drawdowns on lines of 
credit. So that was the issue there. And there was actually a single 
audit done that would have covered the actual drawdown system. 
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So the audit was not necessary in the first place. So it really was 
not the contractor. It was a grantee. 

Chairman LiEBERMAN. So an audit was done. In other words, it 
is not that somebody cheated on their worksheets to describe what 
they were doing. It is that 500 hours were spent 

Mr. Kutz. That were not necessary. 

Chairman LiEBERMAN [continuing]. That were not necessary. 

Mr. Kutz. Correct. That is what that is. Yes. And I think that 
they agree, and they are not going to do that one in the future. 

Chairman LiEBERMAN. When there is such a collapse, if you will, 
or so many shortcomings in an audit, or any organization, obvi- 
ously, there is a lot of blame to go around. But I was very inter- 
ested in your comment. Again, you are drawing from selective 
cases — you could not review every one of the auditors. I para- 
phrased from what you said. Your conclusion from the auditors you 
did interview is that there are thousands of good auditors trapped 
in a broken system, and some of the recommendations you have 
made are clearly systemic. But then some of the responses that I 
have heard today go more to the individual auditors, training op- 
portunities and the like. 

So I am going to ask you first to comment on that, and then ask 
the other witnesses. Is it both, or is it really the system? If it is 
the system, are you talking about the fact that they are trying to 
do too many audits? 

Mr. Kutz. Yes, I really am, and I think Mr. Hale touched on it 
in his opening statement. I agree with him 100 percent. 

Chairman LiEBERMAN. Yes. 

Mr. Kutz. You are trying to do 22,000, or he mentioned 24,000, 
or whether it is 30,000 audits 

Chairman LiEBERMAN. Right. 

Mr. Kutz [continuing]. With 3,600 people. That is not possible. 

Chairman LiEBERMAN. You just cannot do those audits. That is 
22,000 to 30,000 a year. 

Mr. Kutz. Right. You are going to do drive-by audits in some 
cases, where you go by and ask a few questions, look at a couple 
transactions 

Chairman LiEBERMAN. Yes. 

Mr. Kutz [continuing]. And issue an opinion, and you are setting 
up the people in that particular case to fail. You have not given 
them the proper resourcing. Now, I cannot believe there are 22,000 
audits that are necessary. That gets into the risk-based approach 
that we talk about with respect to — and I think Mr. Hale hit it on 
the head — are those audits necessary? Are there things that can be 
done either by redefining audits or looking at what is actually gen- 
erating the audits from the Federal Acquisition Regulation (FAR) 
or whatever the case may be? If you do not deal with that issue, 
I do not think you will ever fix this. 

Chairman LiEBERMAN. That is a very powerful point. Let me go 
back to whether it is a problem with the auditors or it is a problem 
of the system. That is part of the indictment of the system that we 
just talked about, that perhaps they are trying to do too much and 
therefore they are doing a lot badly. But let me ask this direct 
question. Is the leadership inadequate? I know it is awkward, not 
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just for Ms. Stephenson, but anybody, but the supervisors gen- 
erally — 

Mr. Kutz. Well, I think it is an insular culture. I think we talked 
about that. 

Chairman LiEBERMAN. Yes. 

Mr. Kutz. And that is why I think one of our recommendations 
to bring in some outside expertise to take a fresh look at this is 
useful, someone to come in and say, OK, how are we doing these 
audits? How are we deciding which ones to do? Are they all man- 
dated? Do we have to go back to the source and figure out how we 
get down? 

Because, again, I think, if you learn to do an audit where a cou- 
ple of transactions is enough to opine on a system, that does not 
mean you are not a good auditor. It means you were not taught 
how to do an audit correctly. I mean, if I had been brought in as 
an entry-level auditor at DCAA and I learned that is the way you 
do audits, then I would think it was OK. That does not necessarily 
mean I am a bad auditor. It means I really grew up in a system 
where I learned that was the way you do audits because we have 
10 audits to do in the next 2 months and the only way to get them 
done is to do them quickly. 

Chairman LiEBERMAN. Mr. Hale, let me ask you to comment on 
this a bit. I know you are relatively new on the job. I appreciate 
the steps you have taken. When you said you assigned somebody 
on your staff to oversee your liaison with DCAA, is that going to 
be their primary responsibility? 

Mr. Hale. It is probably about half-time. She is doing some other 
things for me 

Chairman LiEBERMAN. Yes. 

Mr. Hale [continuing]. But I will have her devote enough of her 
time to see this through. I told you, I am committed to fixing this. 

Chairman LiEBERMAN. Right. 

Mr. Hale. Yes, it happened on a previous watch, but nonethe- 
less, it is my responsibility now, and I need those eyes and ears 
as we go forward. 

Chairman LiEBERMAN. Right. 

Mr. Hale. There are still a number of issues that need to be re- 
solved. I think we all understand that. 

Chairman LiEBERMAN. Have you, since you have been there, met 
regularly with Ms. Stephenson? 

Mr. Hale. Yes. I see her almost weekly at my staff meetings, and 
we have had a number of one-on-one discussions, and Ms. Stephen- 
son and I are e-mail buddies. 

Chairman LiEBERMAN. Yes. 

Mr. Hale. We have had a lot of exchanges. 

Chairman LiEBERMAN. So do you agree, just to draw you out 
from your testimony, that one of the most significant problems here 
is that DCAA is trying to do too much and therefore it is doing a 
lot of it badly? 

Mr. Hale. You have a tough tradeoff to make. I am concerned 
about that. We need to look at it. On the other hand, I do not want 
to start not doing audits 

Chairman LiEBERMAN. Yes. 
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Mr. Hale [continuing]. That could be productive for the govern- 
ment. 

Chairman LlEBERMAN. Right. 

Mr. Hale. So there is a tradeoff Incidentally, just to clarify the 
numbers, the 30,000 is the total number of engagements. I thought 
it was 24,000 under Generally Accepted Government Auditing 
Standards (GAGAS). Maybe it is 22,000 — well, just to clarify the 
numbers. 

Ms. Stephenson. It is merely a difference of the number of as- 
signments that we do and the number of reports issued. There are 
some assignments that incorporate into a single report, so it is not 
necessarily one-for-one. The number of reports are around 20,000. 

Mr. Hale. So I have talked to Ms. Stephenson about the num- 
bers. I have talked to Shay Assad, who is the Director of Defense 
Procurement and Acquisition Policy. He is the customer. 

Chairman LlEBERMAN. Right. 

Mr. Hale. We need to keep them in mind here. 

Chairman LlEBERMAN. Sure. 

Mr. Hale. I am concerned the pendulum has swung too far. We 
were not paying enough attention to quality. I do not want to swing 
back and ignore the customer or we will not meet DOD’s, the gov- 
ernment’s, and the taxpayers’ needs. So there is a balance to be 
struck. So we have talked to both of them. We need to review the 
numbers. 

Chairman LlEBERMAN. Do you know if you have the statutory 
latitude to selectively audit so you reduce the numbers 

Mr. Hale. I am going to need to get the lawyers involved. 

Chairman LlEBERMAN. Mr. Kutz, do you know? 

Mr. Hale. They may not. Some of it may be the FAR. Some of 
it may be laws. 

Chairman LlEBERMAN. Yes. 

Mr. Kutz. I would defer to DOD. We did not do an in-depth look 
at that. 

Chairman LlEBERMAN. My time is up. Senator Collins. 

Senator Collins. Thank you, Mr. Chairman. 

Ms. Stephenson, I want to read to you your opening testimony 
before our Committee last year on September 10, 2008. You said, 
“Mr. Chairman, I want to assure you and all the members of this 
Committee that DCAA is taking the GAO’s findings very seriously.” 
This year, at the beginning of your testimony, you said, “Please be 
assured that we have taken the GAO’s findings very seriously.” In 
other words, almost the exact same words. But from what I can 
see, very little has changed during the past year. 

I am particularly concerned to learn from my staff that one of 
the executive-level managers from the Western Region who was re- 
sponsible for the problematic audit has actually since been pro- 
moted to the Senior Executive Service. 

So what has really changed since you came before us a year ago 
and assured us that you were taking GAO’s audits very seriously? 
It is not sufficient for you to come back a year later and just repeat 
those same words. I had such hope when I heard that from you last 
year because I knew you were a career employee with a lot of expe- 
rience who had worked her way up in the agency and only several 
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months before our hearing last year had become head of DCAA. 
But words are not enough. We need to see real progress. 

Ms. Stephenson. I agree, Senator, and it is a very fair question 
to ask, and I will say, over the last year, we have made significant 
progress. And let me answer your question in a couple of ways. 

First, the Senior Executive was promoted in October 2007. It was 
not after the hearing, it was a year before the hearing, just to clar- 
ify that. 

Second, the number of actions we have taken have ranged from — 
we completely changed the way in which we conduct the perform- 
ance measures. Feedback from employees has been favorable on 
that. We removed the requirement for employees to meet budget 
hours, which was one of the primary barriers that people felt. That 
was removed actually from the performance standards. Language 
about quality assurance has been inserted in all standards at all 
levels within the organization. 

We completely changed the way in which we review contractor 
documents. No longer do we look at drafts. We only look at a final 
product. We have removed any fixed cycle times on assignments. 
It is now based on the amount of time that is necessary to perform 
a full and complete audit. We have reiterated to our workforce the 
necessary number of transactions that must be reviewed in order 
to express an opinion, and if there is an impairment, such as a 
time constraint from a contracting officer, to have an appropriate 
disclaimer in a report. 

I have numerous actions in which I could go through to describe 
what has changed, but I will explain what employees tell me as I 
visit the offices. They tell me that there has been more positive 
change made in DCAA in the last year than there had been in the 
prior 10 years. They explain that we have put a workforce environ- 
ment in place with our anonymous Web site where they feel they 
can come forward and discuss and disclose allegations of poor man- 
agement or an abusive work environment. 

I feel that although we have a number of changes yet to be done, 
we have made significant progress in this past year. 

Senator Collins. Ms. Stephenson, I want to clarify the issue you 
raised about the manager because you said that the promotion oc- 
curred in October 2007. But in fact, it was a probationary period, 
I am told, that extended for a year. So the information was avail- 
able to you, and yet this woman’s probationary period passed and, 
in fact, she was made permanent in October 2008. 

Ms. Stephenson. That is correct. 

Senator Collins. It is a bit misleading for you to say that she 
was promoted prior to your having knowledge of these issues. 

Ms. Stephenson. It is the difference between promotion 

Senator Collins. That is a big difference. She could have failed 
the probationary period. It could have been rescinded. So you had 
that information. 

Ms. Stephenson. But I did consult with attorneys. We did not 
have enough information to reduce her appraisal below “achieved.” 

Senator Collins. There is something wrong with the perform- 
ance system then. I do not want to spend all our time on one em- 
ployee. 

Ms. Stephenson. I understand. 


VerDate Nov 24 2008 


13:37Apr 18,2011 Jkt053841 PO 00000 Frm 00022 Fmt 6633 Sfmt 6633 P:\DOCS\53841.TXT SAFFAIRS PsN: PAT 



19 


Senator Collins. I want to go to Mr. Kutz and ask a broader 
question. You found clear violations of DCAA policy and procedures 
representing serious departure from what is called the Yellow Book 
standards. To your knowledge, were any of the management per- 
sonnel who were involved in these problematic audits disciplined or 
retrained or counseled? Was action taken? 

Mr. Kutz. Probably on the training front, yes. Counseling, I am 
not sure. Any serious consequences, none I am aware of. 

Senator Collins. Thank you. 

Ms. Fischer, you testified last year that some of the DCAA audi- 
tors were scared to talk to you and were nervous about being seen 
with GAO and telling you what was really going on. Have you seen 
an improvement in that area or is this still a problem? 

Ms. Fischer. I guess I would have to put it in the context of the 
continuing hotlines we are getting 

Senator Collins. Yes. 

Ms. Fischer [continuing]. In our office. Some of the people that 
have come to us have also gone to DCAA’s internal hotline through 
the Web site, and I would say there is a greater comfort level com- 
ing forward in the agency now than there was before. I think the 
management of the hotline is working pretty well, at least in the 
cases we have looked at, and they have shared that information 
with us. 

Senator Collins. Thank you. 

Mr. Hale, my time is almost gone, but let me just make a com- 
ment to you. You expressed your concern about the morale of the 
people working at DCAA, and in a sense, you were cautioning us 
about tipping the balance too far. You said, “I am concerned about 
morale at the agency.” Well, I guess I would say to you, what effect 
do you think that it has on morale when managers who are respon- 
sible for problematic audits get promoted? When there is pressure 
to weaken audit findings? When report after report indicates that 
there is undue pressure for production at the expense of quality? 

It seems to me that those problems have a far more devastating 
impact on the morale of the auditors than our investigations or 
other reports that are trying to get this agency back on track. Ulti- 
mately, you are the person to whom DCAA reports, and I think you 
need to take personal responsibility to get this agency back on 
track. 

Mr. Hale. Senator, I think I may not have been clear enough. 
What I was looking for is a statement from the Committee, which 
you have done, that DCAA performs valued services. I also want 
them to hear that from me. I have said it, and you have said it, 
too. That is what I was driving at, not that we should not solve the 
problems that have been identified here or continue to look at 
them. I am sorry if I was unclear. 

I do worry that the drumbeat of criticism needs to be balanced 
by the fact, as the GAO has pointed out, that there are a lot of good 
people at DCAA trying to do good things, and I want them to con- 
tinue to hear that. 

And I do take this personally. Again, it did occur before I had 
this job, but it is my job to fix it. I am here today to tell you I will 
do my best, and I have devoted a fair amount of my personal time 
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in the midst of a fairly chaotic budget environment and two wars 
to try to make this better. 

Senator Collins. Thank you. 

Chairman LiEBERMAN. Thanks, Senator Collins. 

I had the same reaction Senator Collins expressed in her last 
question, so I appreciate your response. And I will say that, per- 
haps it is because employees of DCAA know the Committee is on 
the case, in fact, the calls from employees to our office have gone 
up over the last year, not down. So I am encouraged to hear that 
though the calls have continued, they seem to reflect some im- 
provement, at least as GAO is getting those calls on its hotline. 
Thanks, Senator Collins. 

Senator Coburn is next. 

OPENING STATEMENT OF SENATOR COBURN 

Senator Coburn. Thank you, Mr. Chairman, and thank you for 
having this hearing. I think it is really important. 

I read a summary of the GAO report last night and, quite frank- 
ly, got sick. There is a culture that is absolutely unacceptable in 
your agency, Ms. Stephenson, and it still exists. It is not about 
doing auditing. It is about getting the work done and looking like 
you are doing the auditing. 

You have been Director since 2008, correct? 

Ms. Stephenson. Correct, sir. 

Senator Coburn. Do you have any auditing experience outside of 
this agency? 

Ms. Stephenson. No. I have been with DCAA since college. 

Senator Coburn. There was a firm called Arthur Anderson. It no 
longer exists because it failed greatly in its ability to do inde- 
pendent audits. If we cannot trust auditors, we cannot trust any- 
body. 

Personally, I can put forward about $50 billion of waste a year 
in the Pentagon — $50 billion. And now I really understand why — 
we have a system that we call an audit that is not an audit. I 
mean, that is essentially what the GAO report is saying. We prob- 
ably would not see much difference without your organization 
there. And although there may have been some changes brought 
forward, the fact that there was a recision of 80 audit reports and 
65 to 69 were not professionally conducted audits, did not meet the 
Federal Accounting Standards Advisory Board (FASAB) accounting 
standards for auditing, to me says we have to start over. 

Mr. Kutz, what would be the effect of ending or phasing out the 
direct bill program at the Pentagon? 

Mr. Kutz. I do not know. 

Senator Coburn. Do you have any comments on that? Ms. Fisch- 
er. 

Ms. Fischer. Well, either DCAA or the Defense Finance and Ac- 
counting Service would need to review vouchers prior to payment, 
or mayb^e the contracting officers. DCAA has assumed this respon- 
sibility for the contracting officers, and the certifying officers in the 
Defense Finance and Accounting Service rely on that work in mak- 
ing payments. 

Senator Coburn. But if we have an agency that is not actually 
performing its function, what control, what safeguards do we have? 
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Ms. Fischer. You do not. 

Senator Coburn. We do not, and that is exactly it. The question 
that comes down to me is, the people responsible, I cannot under- 
stand why they are still there. I do not understand that. I do not 
understand why the management of this agency has not been to- 
tally changed and why people with real experience, with real audit 
experience in the real world, have not been brought in to create a 
culture of true auditing, which means you verify to make sure 
when you claim an audit that it is accurate, and you do the amount 
of testing that is necessary to make that verification. Otherwise, 
you give a qualified opinion, and we do not see that. 

Mr. Chairman, I will not spend all my time on questions. I am 
a little bit too upset to go where I really want to go. But I think 
our Committee, with Senator McCaskill and her experience, should 
look at this thing from the ground up. And I do not doubt that 
some efforts have been made to improve things, but, in fact, Ms. 
Stephenson’s experience coming up, starting as an auditor trainee 
and now leading this agency, tells me that there is a culture that 
is outside of what we would expect of auditing, and it is different 
than the culture anywhere else in this country in terms of when 
you get a certified audit. 

I have been audited as a businessman. It is tough. As a publicly 
traded company, you had better be able to justify what you are say- 
ing. The auditors, you pay them, but you want that unqualified 
opinion when they finish, and you had better be able to prove what 
you are doing is accurate, and I do not think we are anywhere close 
to having the confidence that is the case. And this is our biggest 
agency. It is a half-a-trillion dollars a year. And we know the waste 
that is out there. I mean, in our Subcommittee on Federal Finan- 
cial Management, Senator Carper and I have documented the 
waste, and now I understand why it is there. There is not a check 
on what is going out. 

So I am highly disappointed. I thank the GAO for their insight, 
but I think we ought to stay on this. And I will tell you, morale 
will improve. It will not go down. It will improve when people are 
doing what they are supposed to be doing, getting rewarded for 
doing what they are supposed to be doing rather than checking the 
boxes in a culture that says we will look out for the contractors 
more than we will look out for the American people, and I think 
that is the culture that exists there today. Thank you. 

Chairman LiEBERMAN. Thanks, Senator Coburn. 

I agree with you. Incidentally, the calls that we get from auditors 
in DCAA are exactly along that line. Just help us to make this 
place better. We know we have an important job to do. We feel like 
we are not able to do it now. 

I do not want to jump ahead, but the Committee, just to respond 
to Senator Coburn, is going to stay on this because it is very impor- 
tant. I would say that the number of Members of Congress who 
know that DCAA exists is small, but its responsibilities are enor- 
mous. Its impact on taxpayer spending is enormous. Its impact, as 
Senator Collins said in her earlier statement, on the well-being and 
security of our troops is enormous. 

So we are going to stay on it. In the short-run, I think we are 
going to really focus on you, Mr. Hale, because this group reports 
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to you. You are new there. You do not have responsibility, if you 
will, for how it got to where it is, but you do have a responsibility 
now to fix it, and we are going to figure out a way to stay in touch 
on a regular basis and ask you to report to us, and maybe we will 
come back periodically for hearings on how we are progressing. 

Thanks, Senator Coburn. Senator McCaskill, again, thank you. 

OPENING STATEMENT OF SENATOR MCCASKILL 

Senator McCaskill. Thank you. I used to be a prosecutor before 
I was an auditor, and in the criminal law, we have ordinances, 
then we have misdemeanors, then we have felonies, and then we 
have capital crimes, and criminal conduct ranges from one end to 
the other. In the world of auditing, what has been committed here 
is a capital crime. There can be no greater indictment of an audit- 
ing agency than this GAO report. 

Now, how do we begin to get value out of this audit agency after 
it has had this kind of indictment? I want to make sure I put in 
the record just one of the case studies because, unfortunately, I 
know from experience, most people do not read these. ^ This is an 
audit that was done with one of the five largest DOD contractors 
working in Iraq, initiated in November 2003. 

In September 2005, after nearly 2 years of audit work, the DCAA 
provided draft findings and recommendations to the contractor that 
included eight significant deficiencies. The contractor objected, say- 
ing the auditors did not really understand. The auditors did not get 
the new policies and procedures that were being developed for the 
fast track in Iraq. 

Following those objections, various supervisory auditors directed 
the auditors to revise and delete some work papers, generate new 
work papers, and in one case copy the signature of a prior super- 
visor onto new work papers, making it appear that the prior super- 
visor had approved those work papers. 

On August 31, 2006, after dropping five significant deficiencies 
and downgrading three significant deficiencies for improvement, 
DCAA reported adequate opinion on the contractor’s accounting 
system. The interim audit supervisor, who instructed the lead audi- 
tor to copy and paste the prior supervisor’s name onto the risk as- 
sessment and work papers, was subsequently promoted to the 
Western Region’s Quality Assurance Manager, where he served as 
quality control check over thousands of audits, including some that 
the GAO reported on last year. 

In April 2007, the Special Inspector General for Iraq Reconstruc- 
tion (SIGIR) reported that despite being paid $3 million to com- 
plete the renovation of a building in Iraq, the contractor’s work led 
to plumbing failures and electrical fires in a building occupied by 
the Iraqi Civil Defense Directorate. 

Now, I have one simple question. Has that interim audit super- 
visor been fired? 

Ms. Stephenson. No, ma’am. 

Senator McCaskill. And, in fact, has that interim audit super- 
visor who told that auditor to commit fraud by copying and pasting 
a supervisor’s signature to work papers even been demoted? 


^The case study referenced by Senator McCaskill appears in the Appendix on page 158. 
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Ms. Stephenson. On the work paper copying, that was an issue 
where they had copied work papers from one assignment to an- 
other. It was not deliberate to copy the signature. It happened 
when they copied papers. 

Senator McCaskill. Mr. Kutz, was there, in fact, a copying and 
pasting of an auditor’s signature on a report that auditor super- 
visor had never even seen? 

Ms. Fischer. Senator McCaskill, yes, that did occur because the 
prior supervisor had moved on, and it occurred on a number of 
work papers, even work papers that were created after the signa- 
ture date. 

Senator McCaskill. Mr. Hale, I have to tell you, when we had 
the scandal at Walter Reed, I admired Secretary Gates so much be- 
cause he went to the very top and found accountability. When we 
had the problems at the Air Force, I admired Secretary Gates, and 
I really was beginning to believe that we had in the military now 
someone who understood that when you have a scandal, you must 
have accountability. 

Let me say for the record that no one has been demoted over this 
capital offense. No one has lost his job. And I will tell you, to add 
insult to injury, I do not think the GS-12 auditor even got a letter 
of commendation. In fact, I do not think she has even been pro- 
moted. 

Ms. Stephenson. She has been. 

Senator McCaskill. Well, it is a lateral move. She is training. 
This is not somebody who has been heralded by the agency as a 
hero. I mean, there has been no recognition. She has not been 
called to the Pentagon to be thanked for what she did. And if it 
was not for her, we would not be here. And the people who did this 
are still there. The culture is still there. 

Listen, I know, Ms. Stephenson, you are new, and I know you are 
trying, but we have to come to grips with the fact that people who 
work there work there forever, and their sense of outrage is not 
significant for the American taxpayer and the American military 
right now. 

And honestly, with all due respect, Mr. Heddell, you were not 
there, but how in the world does a peer review happen with a clean 
opinion in 2006 at this audit agency? Who are the people who did 
that peer review? Who said this agency was OK in 2006? Clearly, 
it was not. 

And it is not the quantity of the audits, it is the quality that 
matters. If they do not have quality, they are nothing. It is hard 
enough to get people to read one that is good. The ones that are 
horrible, I mean, who is going to read a DCAA audit right now 
without joking, without laughing about it? 

I honestly have to tell you, Mr. Hale, that you have to go back 
to the Pentagon and you have to tell them this is not good enough. 
If somebody is not fired over this, I do not think anybody should 
ever take this agency seriously again. 

Thank you, Mr. Chairman. 

Chairman LiEBERMAN. Thank you. Senator McCaskill. Senator 
Burris. 
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OPENING STATEMENT OF SENATOR BURRIS 

Senator Burris. Thank you, Mr. Chairman. I want to echo my 
colleague, Senator McCaskill. My experience as a Federal bank ex- 
aminer, as a State comptroller, and on the board of directors leaves 
me to wonder whether or not the Defense Department should not 
have to do what we did in private industry. Senator Coburn made 
mention of what is happening. 

Do you all remember the law that passed here called Sarbanes- 
Oxley, detailing what you do with cost controls? I understand that 
the controls at DCAA were just not very effective at all, but the 
controls in auditing are what really run it. And if the auditor is not 
doing his or her job, there is no reliability. You are the first and 
the last line of defense to determine what is happening to tax- 
payers’ money. I know you do not want to hear a lecture, but from 
what I have read and the testimony I have heard, it really leaves 
a lot to be desired. 

Mr. Hale, I know Sarbanes-Oxley does not apply to the Federal 
Government, but have you all tried to use those standards, which 
cause businesses to have to spend millions of dollars in order to 
make sure that their financial reporting is correct? Why would it 
not be the same thing for the taxpayers’ money with the Defense 
Department? 

Mr. Hale. Well, as you say, that particular law does not apply 
to the Federal Government 

Senator Burris. Sure. 

Mr. Hale [continuing]. But there are extensive standards — you 
can verify that with GAO — that govern both auditing and internal 
controls and management. I am not going to sit here and tell you 
that we do the greatest job in abiding by all of them, but we are 
mindful of them and working on them. 

Senator Burris. Ms. Stephenson, I read in my notes that the 
DCAA also does auditing outside of the Pentagon. So if you do not 
have enough staff — you just hired 700 new people — how are you 
doing outside audits of other agencies? 

Ms. Stephenson. We perform audits for 34 other civilian agen- 
cies on a reimbursable basis. However, we do put the priorities on 
efforts such as the war and other Department initiatives. We have 
deferred a significant number of audits that we were required to 
do under law and regulation since the beginning of the war. So we 
have quite a large backlog, especially of the annual audits of the 
cost-reimbursable contracts. So because we do not have what we 
need, we defer. It is not as though we try to get them all done in 
one year. We recognize that we cannot do that. 

Senator Burris. Now, Mr. Hale, do you, as the Comptroller of 
the Defense Department, authorize the payment of bills? Is that 
your responsibility? 

Mr. Hale. We set the policy for it. The actual authorization is 
done at lower levels in the organization. I do not personally do it. 

Senator Burris. Well, it comes under your jurisdiction? 

Mr. Hale. Yes. 

Senator Burris. Do you also prepare the financial statement for 
the Defense Department as the Comptroller? 

Mr. Hale. Yes. 
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Senator Burris. Is there any type of certification of that finan- 
cial statement, which would come about as a result of what they 
are spending with outside contractors, that the auditors are report- 
ing to you for the accuracy of that statement? 

Mr. Hale. Well, there is an overall audit, and we do not have 
auditable financial statements in the Department of Defense. There 
are also a number of reviews at various levels in the Department 
and outside the Department, by the IG, GAO, and others, of par- 
ticular aspects of those statements. I do not know if that answers 
your question, but overall, the Department’s financial statements 
are not auditable. 

Senator Burris. Mr. Chairman, there is a deep concern here be- 
cause I remember when I was President of the National Associa- 
tion of State Auditors, Comptrollers, and Treasurers, we came to 
Washington to try to get the Federal Government to really begin 
to set up a structure that would allow more accountability to the 
taxpayers, and what the compromise was — we tried to create an 
Auditor General who would take over the auditing of the Federal 
Government’s financial statements, and the current Comptroller 
General of the United States would become the Auditor General, 
and then this person would have the same status as the Comp- 
troller General has now, but he would oversee the financial state- 
ments of the Executive Branch. 

The compromise was this. They set a Comptroller up in the Of- 
fice of Management and Budget (0MB), which is the fourth-level 
person in 0MB, and then they put comptrollers in each one of the 
agencies. That is the reason why I was questioning Mr. Hale. His 
position was created as a result of that action that State govern- 
ments took to bring them in line pretty much with what States 
were doing. And so they did not quite complete it because they said 
that they are too big to operate. I think there is no such thing, but 
we had to compromise in that regard. 

I would certainly like to follow up with that action because the 
whole accounting system of the Federal Government really needs 
to be changed, ^^at you see happening in the Defense Department 
is just a microcosm of what is happening in other agencies, prob- 
ably because what they allege to us is that it is their size. 

Of course, I have also a concern about personnel in terms of 
skills. Ms. Stephenson, in terms of the new hires, are you able to 
hire skilled auditors or certified public accountants? Just who are 
they, and where are you finding these people that you are hiring? 

Ms. Stephenson. The people that we are hiring are generally 
entry-level. Under the Defense Acquisition Workforce Development 
Fund, which is the funding that we have for this, it is entry-level 
interns that are funded for the hiring. So these are entry-level indi- 
viduals. There are no other auditors that perform the functions 
that we perform. 

Senator Burris. What are their skills and qualifications 

Ms. Stephenson. We are contract 

Senator Burris [continuing]. A bachelor’s degree in accounting? 

Ms. Stephenson. Right. It is a degree in accounting, but we are 
contract auditors, and there are no other contract auditors, and so 
we have a very unique technical niche in the auditing arena. But 
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specifically, under the Acquisition Workforce Development Fund, 
that is limited to interns and that is what we have hired. 

Senator Burris. We might have a problem with their skills. Who 
is training these individuals for skills and responsibilities and how 
long is their training period? GAO, did you all get into any of that, 
in terms of the skills of those new hires? 

Mr. Kutz. Not the new hires, but as we mentioned, we believe 
overall that the audit staff are good auditors, and as I mentioned 
in my opening statement, I think they were in a bad system at this 
point. And one of the things that the Department is trying to do 
is take actions to make a better system for them, better training, 
better scoping of audits, and possibly reducing the number of au- 
dits they are required to do so they can do more in-depth kind of 
work that you would expect a normal system-type audit to do. 

Senator Burris. So there is some concern about the work flow 
and the volume of work and the necessity of particular items being 
audited with these contractors? 

Mr. Kutz. Right. We believe that it is difficult to imagine 22,000 
or 30,000 audits being done a year by 3,600 people. I know they 
are trying to hire 700 more auditors, but I still think that denomi- 
nator is a problem. 

Senator Burris. Thank you, Mr. Chairman. My time has expired, 
and I might not be here for the second round, but I would certainly 
like to follow up with this because I would like to talk more about 
the circumstances of the overall system that we tried to get estab- 
lished in the Federal Government. 

Chairman LlEBERMAN. Thanks, Senator Burris. 

You bring a very helpful background and history about this State 
effect on the Auditing Comptroller system of the Federal Govern- 
ment. It is very interesting. 

Mr. Kutz and Ms. Fischer have made some suggestions for 
longer-term consideration that I think the Committee really needs 
to take seriously, which is whether the placement of DCAA within 
the Department is the correct place. Should it be separated from 
the Comptroller? Is there a better place for it to be? Should the 
Deputy Secretary handle DCAA? I know Mr. Hale has said that he 
thinks not. 

But the larger question, which really comes off of the history that 
Senator Burris refers to, is whether, as you suggest, we ought to 
take a look at creating a totally independent auditing agency for 
the Federal Government overall, maybe to go back to that idea of 
an Auditor General. That is something I think I would like to come 
back to. 

We are not going to do a second round. I think we have made 
the point here that this Committee has lost its patience, really, and 
there is too much on the line to not see the kind of aggressive ac- 
tion, decisive action, that Members of the Committee have asked 
for. 

Mr. Hale, I am going to ask you to give us a monthly report. It 
can be a letter, and our staff will work with you on the details of 
it. And then we will probably want to come back and do some more 
specific public hearings on this and other related questions. 

As soon as you are able, it would be of interest to me, anyway, 
to get your reaction to Mr. Kutz’s and Ms. Fischer’s recommenda- 
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tion that part of the problem here is the auditors are trying to do 
too much and they are doing a lot of it badly — in other words, 
DCAA should go to risk-based auditing. I would be interested in 
hearing whether you need statutory changes to do that. We under- 
stand, as you said, and you were right, that when you do that, you 
are running the risk that you are not going to audit a contract and 
you really will look back and say, oh, we should have audited that. 
But anyway, I want to have a more detailed evaluation of that. 

Senator Coburn. Mr. Chairman, would you yield? 

Chairman LiEBERMAN. Senator Coburn, and then we will go to 
Senator McCaskill. 

Senator Coburn. If you create the expectation that you are going 
to get a real audit and you do not know when you are going to get 
the real audit, you will change multitudes of behavior. What needs 
to happen is the suppliers and contractors of the Defense Depart- 
ment need to be very worried about when they come into an audit, 
that, in fact, it is going to be thorough, aggressive, and accurate. 
And if you create that expectation, then you will not have to audit 
everybody every year. But they will not ^ow when they are going 
to get audited, and that is how auditing works best, with the expec- 
tation that they are going to uncover our problems. 

So quality, as Senator McCaskill said. It is not quantity. It is 
quality and then creating an expectation in the rest of the con- 
tractor community that you better have it right. Otherwise, we are 
going to expose it. 

Senator Burris. Mr. Chairman, just one quick point 

Chairman LiEBERMAN. Yes, go ahead, and then we will go to 
Senator McCaskill. 

Senator Burris. Sorry. Thank you. As Senator Coburn men- 
tioned, when I was a bank examiner, surprise, that is what we did. 
The banks did not know when we were coming. 

Chairman LiEBERMAN. Yes. 

Senator Burris. So what Senator Coburn said is exactly what we 
did when I was with the Federal Government. The banks always 
had to be ready because they did not know when the examiners 
were coming in. 

Chairman LiEBERMAN. Yes. To some extent, the Internal Rev- 
enue Service depends on this kind of psychology with the auditing. 
They cannot audit every tax return in the country, but because ev- 
erybody worries that they may be audited, presumably, it encour- 
ages more honesty. 

Senator McCaskill. 

Senator McCaskill. I am almost disappointed we do not have a 
second round so I could be calm during the second round. 

Chairman LiEBERMAN. I prefer to remember you as angry. 
[Laughter.] 

Senator McCaskill. Well, just a couple of things I think we need 
to make sure we have on the record. One is that I know that you 
may find this shocking, but there are hundreds and hundreds of 
auditors around the country that are not doing every audit that 
has been statutorily mandated because you know what legislators 
always do? Legislators always say, audit it in the legislation, and 
they never give the resources to audit it. So auditors are constantly 
struggling with mandated statutory audits that they do not do. 
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That is why the risk assessment system was born. That is why we 
have the single audit, the different levels of programs that are au- 
dited because of risk and the amount of money that is flowing. And 
clearly in a contingency, in a situation like the case study I talked 
about, that is where you have the most risk. And I just really do 
not get this reluctance. 

And I think that leads to the second point, Mr. Chairman. I 
think we need to really stay focused on how insular this agency 
truly is. I have to tell you the truth, Ms. Stephenson, the notion 
that you just testified that there are no other contract auditors out 
there, there are. There are hundreds of auditors that have the 
same government auditing standard background, that have done 
the same kind of scope and work on their audits, that have the 
same kind of supervisory check. I mean, auditing, yes, there are 
different kinds and different expertise, but what you have always 
done in that agency is lateral and promotion. You have never 
brought in anybody from the outside, whether it is on a peer review 
or whether it is on deciding whether or not people get promoted. 
It has always been a birth-to-death organization, and it is dying be- 
cause of it. 

I was going to calmly go through those points in questions if we 
had had a second round. I have a number of questions for the 
record, and I will just let both the Chairman and the Ranking 
Member know that if there is any of this follow-up work that the 
Subcommittee can do — as you can see, I am fairly agitated and in- 
volved in this particular subject matter — in terms of follow-up 
hearings, we are happy to do that on the Subcommittee if that is 
your pleasure and prerogative. Obviously, we leave it to your deci- 
sion as to what work you would like us to do on the Subcommittee. 

Chairman LiEBERMAN. No, I think that is a great idea. You are 
agitated, but you are also experienced, and that is a good combina- 
tion. Senator Collins. 

Senator Collins. Thank you, Mr. Chairman. 

I think it is important for our witnesses to know why we feel so 
strongly and why there is such a sense of outrage among all of us 
who are here today. The first reason is that we are talking about 
contracts that are worth hundreds of billions of dollars. So what we 
have on the line here is an enormous investment by the taxpayers. 

Second, ultimately, we are talking about services and goods in 
the case of DOD that are going to support our troops in harm’s 
way. Senator McCaskill’s example of the Iraq contractor is rep- 
licated over and over again. So if we do not have good audits that 
are catching overbilling, shoddy work, the failure to deliver on a 
contract, contractors who are ripping off the Federal Government, 
the people who are being shortchanged in many cases are the men 
and women who are risking their lives every day for us, and that 
is why this matters so much. 

And third and finally, the frustration you are hearing today is 
that it appears that virtually nothing has changed since we held 
our hearing last year, and that is completely unacceptable. 

So I join the Chairman in his commitment to keep on top of this. 
It is exactly the kind of shoddy work that devalues the very good 
work that is done by the majority of the hard working employees 
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at DCAA whose work I do value and acknowledged in my opening 
statement. 

We have to get this right. We cannot be here next September 
with yet another GAO report that tells us little has changed. 

Thank you, Mr. Chairman. 

Chairman LiEBERMAN. Thanks, Senator Collins. 

I think the time for incremental responses is over. Training pro- 
grams are good, but this organization really needs bold change, and 
we are counting on you, Mr. Hale. Bringing that about is another 
one of the bonuses that comes with your accepting this position. 

The record of this hearing will stay open for 15 days for addi- 
tional questions or statements to be filed for the record. 

I thank everybody. The hearing is adjourned. 

[Whereupon, at 11:38 a.m., the Committee was adjourned.] 
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Opening Statement for Chairman Joseph Lieberman 
Homeland Security and Governmental Affairs 
“Defense Contract Audit Agency: Who Is Responsible for Reform?” 

September 23, 2009 

Good morning and welcome to this hearing where we will examine the 
potential that billions of taxpayer dollars are at risk of being wasted because of the 
inadequate auditing procedures at the Defense Contract Audit Agency - or DCAA. 

DCAA has 300 offices and 3,800 auditors throughout the world, just to give 
you a sense of the scope of the agency. It conducts 30,000 audits a year, covering 
S501 billion in proposed contracts. Thai’s a lot of audits and a lot of money. So 
when it doesn’t do well it has great consequence for the taxpayers. 

A year ago our Committee heard from the Government Accountability 
Office and two auditors from DCAA about alarming problems in DCAA’s Western 
region. 


At that time, the Committee learned that there was widespread failure in 
meeting professional auditing standards in the W^estern region. Time after time, 
DCAA had issued clean audits of contractors that were not supported by the 
underlying audit work. 

In some cases, supervisors had even overturned the audit findings of 
subordinates without a justitication for their decisions. 

Senator Collins and I were concerned that these problems in the western 
region might be symptoms of a systemic problem, rather than a regional one, we 
asked the Government Accountability Office to do a review across all regions of 
DCAA and today we will hear the results of that review. 

Today we hear the results and i am sorry to say that GAO found similar 
problems across DCAA, which has about 3,800 auditors and 300 offices throughout 
the l).S. and overseas. Some of the disturbing findings: 

« Each and everj' audit that GAO reviewed for this report was out of 

compliance with auditing standards — most with very serious deficiencies. 

* A supervisor directed audit staff to delete some audit documents, generate 
others, and copy the signature of a prior supervisor on to the new documents, 
and then issued a clean opinion. This supervisor was later promoted to 
western region quality assurance manager, responsible for the quality 
control of thousands of audits. 
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• One auditor asked supervisors for permission to spend more time on an 
audit of a contractor known to be under criminal investigation for fraud. 

The auditor ultimately drafted an negative opinion that was overturned by 
supervisors, who then, rather than praise the auditor’s efforts lowered his 
performance appraisal for performing too much testing and exceeding 
budgeted hours. 

• In an audit of one of DOD’s largest contractors, the auditor told GAO that 
he did not perform detailed tests “because the contractor would not 
appreciate it.” 

• When auditors reviewed contractor invoices, in many cases they did not look 
to see if the contractor could offer supporting documentation for the goods or 
services they were charging the government for - the auditors simply looked 
at the numbers on the invoices to see if they added up! 

• In reviewing the vouchers of a contractor with over $1.1 billion in annual 
billings to DOD, the auditor tested only 20 of 5,530 vouchers from a one-year 
period and gave the contractor a clean bill of health. Meanwhile, GAO 
investigators were discovering that this same contractor had overbilled the 
government by $400,000 under a contract with the FBI. 

To date, GAO’s two reviews have led DCAA to rescind 80 of its audits, which 
is, 1 gather, a rare - and highly embarrassing - step for an auditing agency. The 
rescission of 80 audits is effectively a self-indictment by DCAA for failure to hold 
audit quality above all else. 

This is the 5th major report sounding the alarm on DCAA. In addition to 
the two GAO reports, we have a 2007 Department of Defense Inspector General’s 
peer review, a report last fall from the Defense Business Council, and a new DOD 
IG report - all showing that an important watchdog agency, DCAA, is in need of an 
overhaul. Washington, we’ve got a problem. 

In my opinion DCAA is in need of a complete cultural transformation. 

DCAA still seems driven by a culture that emphasizes speed and production of 
audits over the quality of results. And DCAA appears to be an incredibly insular 
agency, with little or no infusion of skills from outside the agency. 

It’s time for us to make sure we change this environment with specific steps, 
such as improving audit quality control, increasing training opportunities, and 
developing a strategy to target resources, rather than simply churn out audits to hit 
numerical goals. 
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We want to have a frank discussion today about who ultimately is 
responsible for the reform of DCAA. Certainly, due to DCAA’s unique role, it must 
have the independence it needs to stand up to pressures from both agencies and 
contractors. And perhaps that independence should be strengthened. Perhaps it’s 
time for us to consider separating DCAA from the Department of Defense and 
making it an independent auditing agency. 

But what is also needed right now is strong leadership from the top ranks of 
DOD to help DCAA achieve the necessary transformation and reforms. 

We do not want to be sitting here a year from now discussing the same old 
problems. Let’s identify the root causes and get on to the solutions that the 
taxpayers demand and certainly deserve. 
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Statement of 
Senator Susan M. Collins 

Defense Contract Audit Agency: Who Is Responsible for Reform? 

Committee on Homeland Security and Governmental Affairs September 23, 2009 

★ ★ * 

With the release of today’s Government Accountability Office (GAO) report, we 
once again focus on extensive problems with the quality of audits at the Defense Contract 
Audit Agency (DCAA) and with the management of this watchdog agency. 

The DCAA is the Department of Defense’s (DOD) principal contract auditor. It 
completes more than 30,000 reviews and audits per year that cover hundreds of billions of 
dollars in federal contracts. 

A well-functioning DCAA is thus vital to our government’s responsibility to be 
frugal stewards of taxpayer funds. It plays a necessary role in ensuring the accountability 
and transparency of federal contracts. 

Unfortunately, the GAO report contains the haunting refrain of disturbing past 
reports. It cites: 

• lack of independence from undue influence on audit outcomes by contractors, 

program managers, and some senior management; 

• poor or inadequate audit quality; 

• gross mismanagement of government resources; and, 

• ineffective audit practices that allow contractors to overbill the government - in 

some cases, for millions of dollars. 

The Department of Defense and other federal agencies rely on DCAA to detect 
waste, fraud, and abuse. It is, therefore, unacceptable for this federal policing agency to 
continue to have significant performance failures. 

With more than a little frustration, I note that we are here almost one year to the 
day since the Committee’s last hearing on this very same topic - DCAA’s poor 
performance. 
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During the 2008 hearing, I raised significant concerns about mismanagement at 
DCAA. And yet, here we are again. Three particularly troubling areas still need to be 
addressed. 

First, the GAO report highlights the ongoing lack of rigor and independence of 
DCAA audits, due to coercion by a few errant contractors, program managers, and, on 
occasion, even by DCAA management. DCAA auditors cannot be constrained from doing 
their jobs; they must be able to work in an environment where they are encouraged to 
conduct their oversight in a fair, unbiased, and principled manner. 

There are many principled and dedicated auditors at DCAA who endeavor to 
conduct themselves with the highest possible ethical standards. The management and 
culture at DCAA should support these efforts, not undermine them. 

Second, I am concerned with the DCAA’s lack of urgency in terms of addressing 
and resolving these problems. Recent reviews of DCAA’s reform efforts do not assure me 
that significant progress has been made over the past year. While DCAA has taken some 
steps toward improvement, I believe that too little has been done. 

To date, the DCAA has rescinded some poor quality audit reports and has issued 
guidance to improve the audit quality. The agency also plans to hire 700 additional 
auditors to augment its workforce. 

I am concerned, however, that simply adding resources will not address 
fundamental failings. Indeed, the consequences of mismanagement may only multiply with 
these additional resources. 

Less than a month ago, the DOD Inspector General (IG) completed an investigation 
that found evidence of such mismanagement. It cited time pressure, uncompensated 
overtime, unauthorized changes to audit results, and other unprofessional behavior that 
had created a work environment not conducive to performing quality audits. 

What will it take to see progress? DCAA’s inability to remedy its mismanagement, 
despite numerous hearings, investigations, and reports, is truly an epic failure by the 
agency and the Department. 

Third, the GAO report raises significant questions regarding the need for DCAA 
structural reforms. 

How can it be that DCAA auditors spent more than 530 hours auditing a billing 
system that did not exist and repeatedly change audit findings to make the results 
acceptable to contractors? 
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To make matters worse, I am told some supervisors responsible for deficient audits 
were given performance ratings ranging from “exceeds fully successful” to “outstanding.” 
Let me repeat that. For supervising these questionable audits, these managers were given 
marks of excellence. This is an outrage, plain and simple. 

We rely on the many honest and dedicated employees at DCAA to be the first line of 
defense to the abuse of tax dollars. When the audit agency fails, the fallout can cascade 
through the system, and ultimately shortchange our troops in the field. Congress must 
carefully consider what reforms are needed at DCAA in light of these disclosures. 

Reestablishing DCAA as a first-rate audit agency is critical. To date, I have been 
very disappointed with the lack of leadership from the Office of the Comptroller, which is 
responsible for overseeing and supporting DCAA. 

Action must be taken swiftly to help this agency regain its credibility and restore its 
oversight mission. Once its performance and image have been repaired, it can again 
assume its primary objective; ensuring the best value for the American taxpayer on all 
defense contracts. 
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Mr. Chairman and Members of the Committee: 

Thank you for the opportunity to discuss our recent audit of the Defense 
Contract Audit Agency’s (DCAA) overall management environment and 
quality assurance stiucture. DCAA is charged with a critical role in 
Department of Defense (DOD) contractor oversight by providing auditing, 
accounting, and financial advisory services in connection with the 
negotiation, administration, and settlement of contracts and subcontracts. ‘ 
DCAA’s mission encompasses both audit and nonaudit services in support 
of DOD contracting and contract payment functions. DCAA audits of 
contractor internal controls in accounting, biUing, estimating, and other 
key systems support decisions on pricing and contract awards. Iixternal 
control audits also impact the planning and reliability of other DCAA 
audits because DCAA uses the results of these audits to assess risk and 
plan the nature, extent, and timing of tests for other contractor audits and 
assignments. 

Last year, we reported^ the results of our investigation of allegations about 
certain DCAA audits at three locations in California, which substantiated 
claims that (1) audit documentation did not support the reported opinions; 
(2) DCAA supervisors dropped findings and changed audit opinions 
without adequate audit evidence for their changes; and (3) sufficient work 
was not performed to support the audit opinions and conclusions. At that 
time we were conducting a broader audit of DCAA’s overaU organizational 
environment and quality control system. Given the evidence presented at 
the Committee’s September 2008 hearing, you requested that we expand 
our ongoing assessment. Our current report,® which the Committee is 
releasing today, presents the results of our DCAA-wide audit, including (1) 
an assessment of DCAA’s management environment and quality assurance 
structure; (2) an analysis of DCAA’s corrective actions in response to our 
July 2008 report and two DOD reviews,^ and (3) potential legislative and 
other actions that could improve DCAA’s effectiveness and independence. 


‘ DCAA also perfonns audit services for other federal agencies on a fee-for-service basis. 

® GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet 
Professional Standards Were Substantiated, G AO-08-8f)7 (Washington, D.C.: July 22, 2008). 

® GAO, DCAA Audits: Widesj^read Problems ivilh Audit Quality Require Significant 
Reform, GAO-OO-'JCS (Washington, D.C.: Sept. 23, 2009). 

* DOD reviews induded (1) an Under Secretary of Defense (Comptroller/Chief Financial 
Officer (CFO)) Uger team review and (2) a Defense Business Board Study. 
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To assess DCAA’s overall management environment and quality assurance 
structure, we analyzed DCAA’s mission statement and strategic plan, 
performance metrics, policies and audit guidance, and system of quality 
control. We also reviewed audit documentation for 69 selected audits and 
cost-related assignments at certain field audit offices (FAO) in each of 
DCAA’s five regions for compliance with generally accepted government 
auditing standards (GAGAS)* and other ^plicable standards. We selected 
37 audits of contractor internal control systems performed by seven 
geogr^hically disperse DCAA field offices within the five DCAA regions 
during fiscal years 2004 through 2006.® Our approach focused on DCAA 
offices that reported predominately adequate, or “clean,” opinions on 
audits of contractor internal controls over cost accounting, billing, and 
cost estimating systems issued in fiscal years 2005 and 2006. ' We did this 
because contracting officers rely on these opinions for 3 or more years to 
make decisions on pricing and contract awards, and payment. For 
example, audits of estimating system controls support negotiation of fair 
and reasonable prices.* Abo, the FAR requires contractors to have an 
adequate accounting system prior to award of a cost-reimbursable or other 
flexibly priced contract’ Billing system internal control audit results 
support decisions to authorize contractors to submit invoices directly to 
DOD and other federal agency disbursing offices for payment without 


* GAO, Generally Accepted Govmmeni Audiiiitg StaTulards, CtAO- 03-C73G (WasWngton, 
D.C.: June 3Xi3) and GAO-07-731G (Washington, D.C.: July 2007). 

® Although our selection of the seven ofGces and 37 internal control audits was not 
statistical, it represented about 9 perc^i of the total 76 DCAA offices that issued audit 
reports on contractor internal controls and nearly IS percent of the 40 offices that issued 8 
or more reports on contractor internal controls during fiscal year 2006. Of the 37 internal 
control audits we reviewed, 32 reports were issued with adequate opinions and 5 reports 
were issued with inadequate-in-part opinions- In the cose of follow-up audits, we also 
reviewed the documentation for the previous audit to gain an understanding of the scope of 
work and deficiencies identified in the prior audit. These were the most recently completed 
fiscal years at the time we iniii^ed our audit 

’ In selecting the seven DCAA offices, we considered a 2-year history of internal control 
audit results. The seven DCAA offices we selected reported adequate opinions on 89 
percent or more of the internal control reports they issued during fiscal year 2(X)6. During 
fiscal year 2005, 4 of the 7 offices reported adequate opinions in 85 percent or more of the 
internal control reports they issued, and the other 3 offices issued adequate opinions in 50 
to 69 percent of the internal control audit reports they issued. 

* DCAA Contract Audit Manual (CAM) 5-1202. la and Defense Federal Acquisition 
Regulation Supplement (DFARS) 215.407-5. 

® FAR §U6.I04(h) and 16.30!-3(a)(l). 
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government review.'® Because DCAA uses the results of internal control 
audits to assess risk and plan the nature, extent, and timing of tests for 
other contractor audits and assignments, the conclusions and opinions in 
these audits impact hundreds of other DCAA audits. At the same seven 
DCAA field offices, we selected an additional 32 cost-related assignments 
for review, including 16 paid voucher reviews, 10 overpayment 
assignments, 2 requests for equitable adjustment audits, and 4 incurred 
cost audits that were completed during fiscal years 2004 through 2006. We 
reviewed supporting documentation for the cost-related assigiunents to 
determine whether DCAA auditors were identifying and reporting 
contractor overpayments and billing errors." 

To assess DCAA corrective actions, we reviewed the status and analyzed 
several key actions that DCAA initiated as a result of our earlier 
investigation, including changes in performance metrics policy and 
procedural guidance, as well as DCAA efforts in response to DOD 
Comptroller/Chief Financial Officer (CFO)'^ and Defense Business Board'® 
recommendations. To identify potential legislative and other actions that 
could improve DCAA’s effectiveness and independence, we considered 
DCAA's current role and responsibilities; the framework of statutory 
authority for auditor independence in the Inspector General Act of 1978, 
as amended;'* best practices of leading organizations that have made 
cultural and organizational transformations; our past work on DCAA 
organizational alternatives; GAGAS criteria for auditor integrity, 


FAR § 42.101 and DFARS § 242.803. 

' ' Contractor overpayments can occur as a result of errors made by paying offices, such as 
duplicate payments and payments in excess of amounts billed, and contractor billing 
errors, such as using the wrong overhead rate, failing to withhold designated amounts on 
progress payments, duplicate billings, or billing for unallowable cost Recoveries of 
overpaymeirts can be accomplished through refunds, subsequent billing offsets, or other 
acijustmenLs to correct billing errors. 

Under Secretary of I>efense — Comptroller, Memorandum for Director Defense Contract 
Audit Agency, Subject: Implementation of Corrective Actions (Washington, D.C.; Aug. 20, 
2008), 

Defense Business Board, Report to the Secretary of Defense: Independent Rev-iew Panel 
Report on the Defense Contract Audit Agency, October 2008. 

" Codified in an appendix to Title 5 of the United States Code (hereafter 5 U.S.C. App,). 
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objectivity, and independence; and GAO’s Standards for Internal Ck)ntrol 
in the Federal Government’® on managerial leadership and oversight. 

Throughout our audit, we met with the DCAA Director and DCAA 
headquarters policy, quality assurance, and operations officials and DCAA 
region and FAO managers, supervisors, and auditors. We also met with 
DOD Office of Inspector General (OIG) auditors responsible for DCAA 
audit oversight and DOD OIG hotline office staff. In addition, we met with 
the former DOD Comptroller/CFO to discuss plans for the Office of 
Comptroller/CFO and Defense Business Board reviews, and we continued 
to meet with and obtain information from the new DOD Comptroller/CFO 
and his staff. We also met with the Comptroller’s new DCAA Oversight 
Committee. We conducted our performance audit from August 2006 
through December 2007, at which time we suspended this work to 
complete our investigation of hotline allegations regarding audits 
performed at three DCAA field offices. We resumed our work on the 
performance audit in October 2008 and performed additional work 
through mid-September 2009 to evaluate DCAA’s quality assurance 
program during fiscal years 2007 and 2008, assess DCAA coirective actions 
on identified audit quali^ weaknesses, and consider legislative and 
organizational placement options for DCAA. We conducted our 
performance audit in accordance with generally accepted government 
auditing standards. Those standards require that we plan and perform the 
audit to obtain sufficient, appropriate evidence to provide a reasonable 
basis for our findings and conclusions based on our audit objectives. We 
believe that the evidence obtained provides a reasonable basis for findings 
and conclusions based on our audit objectives. We performed our 
investigative procedures in accordance with quality standards set forth by 
the Council of the Inspectors General on Integrity and Efficiency (formerly 
the President’s Council <m Integrity and Efficiency). 

Today, I will summarize the results of our audit. 


GAO, Standards for Internal Control in the Federal Government, GAO/AiMD-(X>-2l.3.I 
(Washington, D.C.: November 1999). 
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Widespread 
Management 
Environment and 
Audit Quality 
Problems 


We found audit quality problems at DCAA offices nationwide. Of the 69 
audits and cost-related assignments we reviewed, 65 exhibited serious 
GAGAS or other deficiencies similar to those found in our investigation, 
including compromise of auditor independence, insufficient audit testing, 
and inadequate planning and supervision. Although not as serious, the 
remaiiung four audits also had GAGAS compliance problems. In addition, 
while DCAA did not consider 26 of the 32 cost-related assignments we 
reviewed to be GAGAS audits, DCAA did not perform sufficient testing to 
support reported conclusions on that work. According to DCAA officials, 
DCAA rescinded 80 audit reports related to our prior investigation as well 
as the audit leading to today’s report because the audit evidence was 
outdated, insufficient, or inconsistent with reported conclusions and 
opinions and reliance on the reports for contracting decisions could pose a 
problem. About one third of the rescinded reports relate to unsupported 
opinions on contractor internal controls and were used as the basis for 
risk-assessments and planning on subsequent internal control and cost- 
related audits. Other rescinded reports relate to Cost Accounting 
Standards (CAS) compliance and contract pricing decisions. Because the 
conclusions and opinions in the rescinded reports were used to assess risk 
in planning subsequent audits, they impact the reliability of hundreds of 
other audits and contracting decisions covering billions of dollars in DOD 
expenditures. 

A management environment and agency culture that focused on 
facilitating the award of contracts and an ineffective audit quality 
assurance structure axe at the root of the agencywide audit failures we 
identified. DCAA’s focus on a production-oriented mission led DCAA 
management to establish policies, procedures, and training that 
emphasized performing a large quantity of audits to support contracting 
decisions and gave inadequate attention to performing quality audits. An 
ineffective quality assurance structure, whereby DCAA gave passing 
scores to deficient audits compounded this problem. 

Although the reports for all 37 audits of contractor internal controls that 
we reviewed stated that the audits were performed in accordance with 
GAGAS, we found GAGAS compliance issues with all of these audits. The 
issues or themes are consistent with those identified in our prior 
investigation. 


Of the 69 DCAA assignments we reviewed, 37 were audits of contractor systems and 
related internal conuols and 32 were cost related audits and assignments. 
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Lack of independence. In seven audits, independence was compromised 
because auditors provided material nonaudit services to a contractor they 
later audited; experienced acc^ to records problems that were not fully 
resolved; and significantly delayed report issuance, which allowed the 
contractors to resolve cited deficiencies so that they were not cited in the 
audit reports. GAGAS state that auditors should be free from influences 
that restrict access to records or that improperly modify audit scope. 

Insufficient testing. Thirty-three of 37 internal control audits did not 
include sufficient testing of internal controls to support auditor 
conclusions and opinions. GAGAS for examination-level attestation 
engagements require that sufficient evidence be obtained to provide a 
reasonable basis for the conclusion that is expressed in the report. For 
internal control audits, which are relied on for 2 to 4 years and sometimes 
longer, the auditors would be expected to test a representative selection of 
transactions across the year and not transactions for just one day, one 
month, or a couple of months.'* However, we found that for many 
controls, the procedures performed consisted of documenting the 
auditors’ understanding of controls, and the auditors did not test the 
effectiveness of the implementation and operation of controls. 

Unsupported opinions. The lack of sufficient support for the audit 
opinions on 33 of the 37 internal control audits we reviewed rendered 
them unreliable for decision making on contract awards, direct-billing 
privileges, the reliability of cost estimates, and reported direct cost and 
indirect cost rates. For example, we found that: 

• For many controls, DCAA did not perform any testing at all. For 
example, audits of contractor accounting systems do not include any 
transaction testing. Instead, these audits focus on a review of the 
adequacy of contractor policies and procedures. At least six of the nine 
accounting audits we reviewed did not include procedures for 
confirming contractor segregation of allowable and unallowable cost. 


’’See (JA(;M)3-673G. § a 19, and (iAO-07-7.31G. § 3.10. 

'* GAC)-0a073G, § 6.04b. 

AICPA Statements on Auditing Standards, Al) 350 and Audit and Accounting Guide: 
Audit Sampling, §§ 3. 14, 3.29-3.34, 3.58, and 3.61 . 
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• DCAA issued an adequate opinion on the accounting system for a 
major DOD contractor after performing a walkthrough of the 
accounting process and interviewing two employees. 

• In billing system audits we reviewed, DCAA auditors often tested only 
two, three, or sometimes five transactions to support audit conclusions 
on contractor systems and related internal controls. Further, the 
auditors performed limited procedures such as determirung whether 
the vouchers were mathematically correct and included current and 
cumulative billed amounts. Twenty of the 22 billing system audits we 
reviewed did not include tests to identify duplicate invoices. 

• DCAA auditors reported on the adequacy of a contractor’s billing 
system based on tests of four vouchers, all issued on the same day. 

• In an audit of controls over indirect and other direct cost for a business 
segment of one of the top five DOD contractors, DCAA auditors tested 
12 out of about 22,000 transactions processed from May through July 
2005. 

We also found that reports did not adequately disclose the criteria used in 
performing individual audits. According to GAGAS, audit reports should, 
among other matters, identify the subject matter being reported and the 
criteria used to evaluate the subject matter. Criteria identify the required 
or desired state or expecU^on with respect to the program or operation 
and provide a context for evaluating evidence and understanding the 
findings.” None of the 37 internal control audit reports we reviewed cited 
specific criteria used in individual audits. Instead, the reports uniformly 
used boilerplate language to state that DCAA audited for compliance with 
the “FAR, CAS, DPARS, and contract terms.” As a result the user of the 
report does not know the ^ecific Federal Acquisition Regulation (FAR), 
Cost Accounting Standards (CAS), or contract terms used as criteria to 
test contractor controls. This makes it difficult for users of the reports to 
determine whether the reports provide the level of assurance needed to 
make contracting decisions. 

Similarly, the 32 cost-related assignments we reviewed did not contain 
sufficient testing to provide reasonable assurance that overpayments and 
billing errors that might have occurred were identified. As a result, there is 
little assurance that any such errors, if they occurred, were corrected and 
that related improper contract payments, if any, were refunded or credited 


”0,A(44)7-7310, §4.15. 
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to the government Contractors are responsible for ensuring that their 
billings reflect fsur and reasonable prices and contain only allowable costs, 
and taxpayers expect DCAA to review these billings to provide reasonable 
assurance that the government is not paying more than it should for goods 
and services. We identified the following problems with these 
assignments. 

Paid voucher reviews. DCAA performs annual testing of paid vouchers 
(invoices) to determiire if contractor voucher preparation procedures are 
adequate for continued contractor participation in the direct-bill 
program.** Under the direct-bill program, contractors may submit their 
invoices directly to the DOD disbursing officer for payment without 
further review. Although DCAA does not consider its reviews of contractor 
paid vouchers to be GAGAS engagements, it has not determined what 
standards, if any, apply to these assignments. In addition, for the 16 paid 
voucher assignments we reviewed, we found that DCAA auditois failed to 
comply with DCAA Contract Audit Manual (CAM) guidance.** Rather than 
documenting the population of vouchers, preparing sampling plans, and 
testing a random (statistical) sample, auditors generally did not identify 
the population of vouchers, did not create sampling plans, and made a 
small, nonrepresentative selection of as few as one or two invoices for 
testing to support conclusions on their work. The auditors performed 
limited procedures such as determining whether the vouchers were 
mathematically correct and included current and cumulative billed 
amounts. Based on this bmited work, the auditors concluded that controls 
over invoice preparation were sufficient to support approval of the 
contractors’ direct billing privileges. This is of particular concern because 
we determined that Defense Finance and Accounting Service (DFAS) 
certifying officers rely on DCAA voucher reviews, and they do not repeat 
review procedures they bebeve to be performed by DCAA. 

Overpayment assi^ments. DCAA performs overpayment assigiunents 
to verify that contractors have billing procedures and internal controls in 
place to identify and resolve contractor billing errors and overpayments in 
a timely manner. DCAA guidance states that these engagements should be 
conducted in accordance with GAGAS to the extent applicable under the 


DCAA does not perform paid voucher reviews during the year that it performs an audit of 
the contractor’s billing system internal controls. 

** CAM 6-1007. 
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circumstances.^ However, none of the 10 overpayment assignments we 
reviewed were performed or reported as GAGAS engagements. We found 
that auditor judgments ^out the population and selection of transactions 
for these assignments did not provide a representative universe for testing 
and concluding on contractor controls over billings and payments 
received. For example, for the 10 assignments we assessed, the auditors 
selectively reviewed an accounts receivable aging report to identify 
overpayments and determine if they had been resolved. As a result, this 
work does not provide reasonable assurance that contractors have 
adequate controls in place to identify and correct overpayments and 
billing errors and make ^propriate, timely refunds and adjustments. 

Incurred cost audits. The purpose of incurred cost audits is to examine 
contractors’ cost representations and opine on whether the costs are 
allowable, allocable to government contracts, and reasonable in 
accordance with the contract and applicable government acquisition 
regulations. ** DCAA performs these audits as GAGAS attestation 
engagements. For the four incurred cost audits we reviewed, we found 
that the auditors did not adequately document their judgments about 
control risk or the sampling and test methodologies used. In addition, we 
found that the auditors traced claimed pool and base costs (indirect costs) 
to the contractors’ accounting books and records to determine their 
accuracy and allowability However, the auditors did not perform 
sufficient, detailed testing of claimed indirect and direct costs. For 
example, the auditors traced and reconciled indirect costs to contractor 
accounting system data, but did not test a representative selection of 
direct costs. As a result, the scope of work performed was not sufficient to 
identify claimed costs, if any, that were not adequately supported or 
unallowable costs, if any, that should have been question^. 

Production environment and audit quality issues. DCAA’s mission 
statement, strategic plan, and metrics all focused on producing a large 
number of audit reports and provided little focus on assuring quality 
audits. For example, DCAA’s current approach of performing 30,000 to 
35,000 audits and issuing over 22,000 audit reports with 3,600 auditors 
substantially contributed to the widespread audit quality problems we 
identified. Within this environment, DCAA’s audit quality assurance 


“ EICAA, “Audit Program; Audit of Contractor Oveip^^ents,” (Activity Code 17310), April 
2004, Sc^cmber 2007, and May 2008. 

“ CAM 6-102. 
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program was r\ot properly implemented, resulting in an ineffective quality 
control process that accepted audits with significant deficiencies and 
noncompliance with GAGAS and DCAA policy. Moreover, even when 
DCAA’s quality assurance documentation showed evidence of serious 
deficiencies within individual offices, those offices were given satisfactory 
ratings. Considering the large number of DCAA audit reports Issued 
annually and the reliance the contracting and Unance communities have 
placed on DCAA audit conclusions and opinions, an effective quality 
assurance program is key to protecting the public interest. Such a program 
would report review findings along with recommendations for any needed 
corrective actions; provide training and additional policy guidance, as 
appropriate; and perform follow-up reviews to assure that corrective 
actions were taken. GAGAS require that each audit organization 
performing audits and attestation engagements in accordance with GAGAS 
should have a system of quality control that is designed to provide the 
audit organization with reasonable assurance that the organization and its 
personnel comply with professional standards and applicable legal and 
regulatory requirements, and have an external peer review at least once 
every 3 years.” 

DCAA officials advised us that going forward, DCAA will no longer rate an 
FAO’s overall compliance with GAGAS and DOD policy. The officials told 
us that instead, DCAA headquarters plans to (1) report the detailed results 
of the audit quality reviews, (2) make recommendations to FAOs for any 
needed corrective actions, (3) conduct foUow-up reviews for all FAOs with 
identified audit deficiencies to ensure that corrective actions are taken, 
and (4) provide training and policy guidance, as appropriate. If properly 
implemented, these procedures would help to assure an effective audit 
quality assurance program. 

In addition, the DOD IG reported an adequate (“dean”) opinion on DCAA’s 
most recent peer review results although the reported evidence indicated 
that numerous audits had serious deficiencies in audit quality.® In 
conducting DOD’s audit oversight review of DCAA audits, DOD IG audit 
oversight reviewers considered the same results of DCAA’s internal audit 
quality assurance reviews that we analyzed and reviewed numerous 
additional audits, which also identified significant GAGAS noncompliance 


”(?A()-07-7:{lG, |§ 3.50^.52. 

” All 10 categories of recommendaiions in the DOD IG’s report related to GAGAS 
compliance problems. 
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as evidenced by DOD IG peer review findings and recommendations. 
Although the DOD IG report contained evidence of significant, systemic 
noncompliance with professional standards throughout DCAA audits that 
OIG staff reviewed and the IG report included numerous findings and 
recommendations related to those issues, the DOD IG gave DCAA a 
“clean” peer review opinion,*^ concluding that for audits and attestation 
engagements performed during fiscal year 2006, “ . . . the internal quality 
control system was operating effectively to provide reasonable assurance 
that DCAA personnel were following established policies, procedures, and 
applicable auditing standards. . 

The overall report conclusion in the DOD IG report is inconsistent with 
the detailed observations in the report, which indicate numerous 
significant deficiencies in DCAA’s system of quality control. Furthermore, 
of the 80 audit reports that DCAA rescinded, 39 of the rescinded reports 
were issued during fiscal year 2006 — the period covered by the last DOD 
IG peer review. Therefore, we have concluded that DCAA’s quality control 
system for the period covered by the last DOD IG peer review was not 
effectively designed and implemented to provide assurance that DCAA and 
its personnel comply with professional standards. 


DCAA Is MEkin2 Although DCAA has taken several positive steps, much more needs to be 

® done to address widespread audit quality problems. DCAA’s production- 

Progress, but oriented culture is deeply imbedded and will likely take several years to 

SuSt£lin6d Lcad6rship under DCAA’s decentralised management environment, there had 

• u T ^ been little headquarters oversight of DCAA regions, as demonstrated by 
Slid OVOrSlgnt Is the nationwide audit quality problems. DCAA’s mission focused primarily 

on producing reports to support procurement and contracting community 
decisions with no mention of qu^ty audits that serve taxpayer interest. 
Further, DCAA’s culture has focused on hiring at the entry level and 
promoting from within the agency and most training has been conducted 
by agency staff, which has led to an insular culture where there are limited 
perspectives on howto imke effective organizational changes. 


DCAA corrective actions. DCAA initiated a number of actions to address 
findings in our July 2008 report, the DOD Comptroller/CFO August 2008 
“tiger team" review, and the Defense Business Board study, which was 


^ DOD Inspector General, Ch/ersi-ght Review: Review of the Defense Contract Audit 
Agency Quality Control System, Report No. D'2007-6-006 (Arlington, VA: May 1, 2007). 
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officially released in January 2009. Examples of key DCAA actions to date 
include the following. 

• Eliminating production metrics and implementing new metrics 
intended to focus on achieving quality audits. 

• Estad)lishing an anonymous Web site to address management and 
hotline issues. DCAA's Assistant Director for Operations has been 
proactive in handling internal DCAA Web site hotline complaints. 

• Revising policy guidance to address auditor independence, assure 
management involvement in key decisions, and address audit quality 
issues. DCAA also took action to halt auditor participation in nonaudit 
services that posed independence concerns. 

Further, DCAA has enlisted assistance from other agencies to develop a 
human capital strategic plan, assist in cultural transformation, and 
conduct a staffing study. In March 2009, the new DCAA Comptroller/CFO 
established a DCAA Oversight Committee to monitor and advise on DCAA 
corrective actions. 

While these are positive actions, other DCAA actions have focused on 
process improvements, and DCAA has not yet addressed the fundamental 
weaknesses in its mission, strategic plan, audit approach, and human 
capital practices. 

Although DCAA is making progress, we are concerned that DCAA actions 
to date evidence some of the past cultural problems that could limit their 
success. For example, DCAA identified the following six new performance 
metrics as focusing on the intended outcome-related goal of achieving 
quality audits that comply with GAGAS. “ 

1. Obtaining an unqualified DOD IG peer review opinion. 

2. DCAA’s internal quality assurance program results show that 100 
percent of the audits reviewed reflected professional judgment. 

3. Checklist confirmation that issued reports did not include serioris 
deficiencies. 

4. A goal that 45 percent of audit reports will have findings as an 
indication of the tangible value of the audit work performed. 


“DCAA also established contracting officer sustention rates related to questioned cost and 
net savings as an informational goal to show return to the taxpayer. 
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5. A goal that 15 percent of the audits will use quantitative methods to 
measure the extent to which advanced level audit techniques are used. 

6. A goal that auditors will meet ICK) percent of their continuing 
professional education requirements on time. 

Given the problems with DOD IG peer review results and DCAA’s 
ineffective quality assurance program, for these metrics to achieve the 
intended audit quality goal, significant changes will be needed. DCAA also 
retained three performance metrics that address issuing seports within 
specified times to support contract awards and closeouts, for example: 

1. A forward-pricing audit timeUness goal of 95 percent based on 
agreement with requesters. 

2. Incurred cost audit timeliness goals of 90 percent of corporate audits 
completed within 12 months, 90 percent of major contractor audits 
completed in 15 months, and 95 percent of non-m^or contractor audits 
completed in 24 months. 

3. An efficiency goal of cost per direct audit hour of less than $ 1 13.45 to 
be monitored at the agency level only. 

It is critical that agreements with the contracting community on timeliness 
goals for forward-pricing and incurred cost audits allow performance of 
sufficient audit procedures to help contracting oi^cers ensure that prices 
paid by the government are fair and reasonable, and that contract costs 
comply with ^plicable laws, regulations, cost accounting standards, and 
contract terms. 

Risk-based audit approach. DCAA did not agree to develop a risk-based 
audit approach, as recommended by the Defense Business Board. DCAA 
lacks a risk-based audit approach to address how it will perform required 
audits with available audit resources, reassess the need to perform 30,000 
or more ciudits annually and the appropriate level of audit resources, and 
establish priorities for performing quality audits that meet GAGAS within 
available resources. While resources are a key element of a risk-based 
planning approach, DCAA is performing the Defense Business Board 
recommended staffing study as a stand-alone effort rather than performing 
this study in concert with an effort to establish a risk-based planning 
process. 

DCAA policy guidance. DCAA’s new policy guidance on adequate audit 
documentation and testing does not contain sufficient instruction to 
assure that auditors (1) adequately document significant decisions 
affecting the audit objectives, scope and methodology, findings, 
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conclusions, and recommendations and (2) perform sufficient work to 
support decisions to ^prove contractors for direct-bill status. For 
example, 

• DCAA’s new policy on “Workpaper Documentation of Judgmental 
Selections” — requires a description of the universe (population) from 
which items are selected for testing, identification of items and 
attributes to be tested, and an explanation to support that the 
judgmental selection will result in adequate audit coverage. 

Emphasizing the requirement that audit documentation include a 
description of the population used for sampling and identification of 
items and attributes to be tested is appropriate. However, the 
requirement for an ejq^lanation in the audit documentation that the 
Judgmental selection will result in adequate audit coverage needs to be 
sufficiently justified. GAGAS and AICPA standards require that 
auditors document si^uficant decisions affecting the audit objectives, 
scope and methodology, findings, conclusions, and recommendations 
resulting from professional judgment.** 

• DCAA’s new policy on “Audit Guidance for Annual Testing of 
Contractor Eligibility for Direct Bill” is intended to determine whether 
continued reliance can be placed on the contractor’s procedures for 
preparation of interim vouchers. This policy change clarified and 
consolidated audit steps related to the contractor’s compliance with 
contract provisions, added audit steps for reviewing vouchers under 
time-and-material and I^or-hour contracts, and removed the 
requirement to verify that the contractor’s Central Contractor 
Registration is current. The policy memorandum states that this scope 
of work perfonned does not constitute an audit or attestation 
engagentent under GAGAS. 

While it is within DCAA’s purview to determine whether these 
procedures constitute an audit, because direct-bill decisions present a 
risk of undetected improper contract payments, prudent decisions to 
continue a contractor’s direct-bill authorization would necessarily be 


** <lA()-h7-TaKl, § 3.38 and AU § 339.12. 
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based on testing a statistical sample of invoices® and include a review 
of supporting documentation, including documentation to confirm the 
government received goods and services noted on the billing invoice. 
We confirmed that Defense Finance and Accounting Service certifying 
officers rely on DCAA reviews and that they do not repeat review 
procedures they believe to be performed by DCAA. 

In addition, EiCAA’s policy to eliminate the “inadequate-in-part” opinion 
for contractor interna! control systems audits does not recognize different 
levels of severity of control deficiencies and weaknesses and could 
unfairly penalize contractors whose systems have less severe deficiencies 
by giving them the same opinion — "inadequate" — as contractors having 
material weaknesses or significant deficiencies that in combination would 
constitute a material weakness. DCAA would benefit from outside 
expertise to develop effective audit policy guidance and training on 
auditing standards. 


Legislative and Other 
Actions Could Further 
Improve DCAA 


In addition to correcting the fundamental weaknesses in DCAA's mission 
and overall management environment, we believe certain legislative 
measures as weU as other actions could enhance DCAA’s effectiveness and 
independence. For example, granting DCAA certain authorities and 
protections — similar to those offered to presidentially appointed 
inspectors general (IG) under the IG Act*'— could enhance DCAA’s 
independence. The IG Act contains provisions that enhance the 
independence of presidentially appointed IGs, including protections from 
removal without congressional notification, access to independent legal 
counsel, public reporting of audit results, rights to take statements from 


® Disbursing officers are authorized to make payments on the authority of a voucher 
certified by an authorized certi^ng ofTicer, who is responsible for the legality, accuracy, 
and propriety of the payment. 31 U.S.C. §§ 3325, 3527(c). DOD 7000.14-R, Department of 
Defense ftnancMi Management /Isgvtalwn (DFMR), Vol. S, Ch. II (March 2009), paras. 

1 10102, 1 10203. In general, ceitilying officers designated in writing by the agency are 
financially liable for any improper, illegal, or incorrect payment made, and each payment 
made must be audited (or “examined”). 31 U.S.C. §& 3521(a), 3528(a> DFMR, Vol 5,Ch. 33 
(April 2005), para. 330^. However, 31 U.S.C. § 352lCb) authorizes heads of agencies to 
carry out a statistical sampling procedure, within certain parameters, to audit vouchers 
when the head of the agency determines thal economies will result Further, 31 U.S.C. § 
3521(c) provides that certifying and disbursing officials are not liable for payments that are 
not audited if they were made in good faith under a statistical sampling procedure. See 68 
Comp. Gen. 618 (1989); also see generally. GAO, Policy and Procedures Manual for 
Guidance of Federal Agencies, title 7, §§ 6-5. 7.4, and 7.5 (Washington, D.C.: May 18, 1993). 

Codified in an appendix to Title 5 of the United States Code. 
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contractor and other personnel, and budget visibility. These provisions 
would enhance the important DCAA initiatives currently under way. In the 
longer term, Congress could consider changes m organizational placement 
after DCAA has had sufficient opportunity to effectively implement 
current reform e^orls. However, moving DCAA as an organization would 
require careful analysis and planning before implementation. Continued 
monitoring and oversight will be essential to assuring the successful 
implementation of DCAA’s management initiatives. 


Our 

Recommendations 
and DOD’s Response 


Our report contains several recommendations to DOD as well as matters 
for congressional consideration intended to strengthen DCAA in fulfilling 
its contract audit responsibilities. Our report also discusses matters for 
congressional consideration that could enhance DCAA’s effectiveness and 
independence. These recommendations and matters are discussed below. 


We made 17 recommendations to improve DCAA’s management 
environment, audit qi^ity, and oversight, including 15 recommendations 
to DOD and 2 recommendations to the DOD IG regarding DCAA’s last peer 
review. DOD fully J^reed with 13 of the 15 recommendations, partially 
concurred on one recommendation and did not concur with one other 
recommendation. We view DOD comments as being generally responsive 
to the intent of our recommendations. 


DOD partially concurred with our recommendation that DCAA consult 
with DOD stakeholders and engage outside experts to develop a risk- 
based contract audit approach that identifies resource requirements and 
focuses on performing quality audits that meet GAGAS. DOD stated that 
DCAA already has a risk-based contract audit approach that identifies 
resource requirements and focuses on performing quality audits that meet 
GAGAS. However, DOD stated that DCAA will coordinate with the Under 
Secretary of Defense for Acquisition. Technology, and Logistics (USD 
(AT&L)) to assess DCAA audit requirements.® DOD expects to complete 
its assessment of stakeholder needs based on regulatory and statutory 
requirements by December 2010, 


“ The USD (AT&L) is responsible under 10 U.S.C. § 133 for establishing DOD policies 
related to the negotiation, award, and administration of contracts, such as those related to 
the use of contract audit services, and for coordinating contract audit activities within 
DOD. 
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We appreciate these steps; however, we remain concerned that DCAA’s 
current approach of performing 30,000 to 35,000 audits and issuing over 
22,000 audit reports with 3,600 auditors substantially contributed to the 
widespread audit quality problems we identified. Generating that many 
reports and doing that many audits with 3,600 auditors leaves very little 
time to perform in-depth, complex audits of contractors. 

DOD did not concur on our recommendation to develop policies and 
procedures related to diiect-billing decisions, stating that (1) the 
department believes that a review of the contractor’s interim public 
vouchers Is an integral function of DCAA’s continued assessment of a 
contractor’s billing system, (2) DCAA is in the best position to review and 
approve contract interim billings based on its thorough understanding of 
the contractor’s system, (3) DOD believes that our concerns are mitigated 
based on comprehensive supervisory and audit manager reviews, and (4) 
DCAA does not believe that the approval of interim vouchers along with 
the ^proval for contractors to be on direct billing results in a lack of 
auditor objectivity. 

We continue to believe that DCAA’s management (nonaudit) responsibility 
to perform prepayment reviews of contractor vouchers for DOD and the 
auditor’s decision-making role of approving contractors for direct-billing 
privileges based on its audit conclusions about the strength of the 
contractor’s system of internal controls, create audit objectivity issues. 
Under normal circumstances, DCAA auditors must review contractor 
vouchers prior to payment — a management support function for DOD. By 
obtaining direct-billing privileges, however, contractors can receive 
payment for goods and services without a voucher review by DCAA prior 
to payment. Because we found that this situation created an incentive for 
DCAA to reduce its workload by recommending that contractors are 
placed on direct billing, we recommended that DCAA develop new policies 
and procedures to ensure a separation between staff reviewing vouchers 
and staff making direct-bill decisions. DCAA did not explain the basis for 
its belief that DCAA administrative staff have a thorough understanding of 
the contractors’ systems. Further, we disagree with DOD’s statement that 
our concerns are mitigated based on the comprehensive super\1sory and 
audit manager reviews because this is not supported by our findings. The 
fact that DCAA approvals of contractor direct-bUl privileges were not 
based on sufficient audit procedures as demonstrated by our work and 
DCAA’s removal of over ^0 contractors from the direct-bill program since 
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our July 2008 report” support our concern that the existence of such an 
incentive presents an objectivity impairment 

With regarrf to our two recommendations to the DOD IG, the IG concurred 
on our recommendation to reconsider the overall conclusions in its May 
2007 peer review report on its audit of DCAA’s system of quality control. 
However, the IG did not agree with our recommendation to determine 
whether the report should be rescinded or modified and did not take 
action to do so. The IG comments stated that the IG took alternative action 
that conformed to the intent of our recommendation, including 
notification of DCAA on August 24, 2009, that the May 2007 "adequate” 
opinion on DCAA’s system of quality control would expire on August 26, 
2009. In addition, the IG stated, “We have determined that it is not prudent 
to allow the adequate opinion from our May 2007 report to carry forward.” 
However, peer review opinions neither “expire" nor “carry forward” 
beyond the period covered by the peer review. Based on the significant 
audit quality deficiencies identified in the IG peer review report, DCAA’s 
decision to rescind 80 audit reports — 39 of which relate to the period of 
the IG’s peer review — and the findings in our audit, we concluded that 
DCAA's quality control system for the period covered by the DOD IG peer 
review was not effectively designed and implemented to provide 
assurance that DCAA and its personnel comply with professional 
standards. 

DOD also provided comments on our matters for congressional 
consideration. Although DOD disagreed with the matters we discussed, we 
continue to believe these are valid matters for congressional 
consideration. The IG Act provides many important authorities and 
protections for IG’s that could enhance DCAA’s independence and 
effectiveness. Further, if DCAA is unsuccessful in addressing our 
recommendations for resolving fundamental weaknesses in its mission 
and the overall management environment under the current organizational 
placement, additional options would need to be considered. 


Mr. Chairman and Members of the Committee, this concludes my 
statement. We would be pleased to answer any questions that you may 
have at this time. 
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Chairman Lieberman, Ranking Member Collins, and distinguished 
members of this committee — thank you for the opportunity to appear today before 
the committee to discuss continuing actions by my office to enhance the Defense 
Contract Audit Agency’s (DCAA) key role as a Department of Defense (DoD) 
watchdog over the billions of dollars spent by the Department in contracts. DCAA 
is critical to the Department’s ability to effectively execute its diverse mission. 

It is an objective of the Department of Defense Inspector General, (DoD 
IG), to verify that DCAA audits and the audits of all DoD audit agencies comply 
with stringent standards. The DoD IG is engaged and continues its commitment to 
monitoring and evaluating the effectiveness of DCAA, DoD’s largest audit 
agency, in performing contract audits and providing accounting and financial 
advisory services to all DoD components as well as other federal organizations. 

We recognize, based on our efforts and those of the Government 
Accountability Office, that significant vulnerabilities continue to exist in DCAA’s 
implementation of auditing standards in terms of guidance and execution. DCAA 
auditors must be properly trained, developed, and managed so that they can 
conduct audits within required standards. We are pleased to note that senior DoD 
leadership is now actively engaged in addressing DCAA’s deficiencies and 
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management ehallenges. This focus is necessary to ensure that DCAA audits and 
financial advisory services are accurate, timely, and responsive, so as to prevent 
and detect fraud, waste, and abuse and ensure the proper use of public funds. 

DCAA MANAGEMENT ISSUES 
Compliance with Audit Standards 

The hearing held by this committee last year highlighted several issues 
within DCAA that were identified by my office and the GAO. 

On May 1, 2007, we concluded the “Review of the Defense Contract Audit 
Agency Quality Control System” (the “peer review”) and issued a report (D-2007- 
6-006). We determined that DCAA warranted an “adequate” opinion, because the 
10 deficiencies identified were not cumulatively significant enough to have a 
material impact on the overall system of quality control. In that report, we made 
20 recommendations for improvement to DCAA audits and its quality assurance 
program, DCAA has taken action on 16 of these recommendations. 

On July 22, 2008, GAO issued a report titled, “Allegations That Certain 
Audits at Three Locations Did Not Meet Professional Standards Were 
Substantiated,” GAO-08-0857. GAO reported on 13 cases involving 76 audits 
that did not comply with generally accepted government auditing standards 
(GAGAS). 
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DCAA Workplace Environment 

In the July 2008 report, GAO also found that an abusive work environment 
existed at two field audit offices (FAOs). Problems identified included 
involuntary reassignment, threats of disciplinary action against auditors because 
they would not drop audit findings or draft favorable reports, and fear of 
retaliation among auditors for speaking with GAO representatives. 

ONGOING IG DOD OVERSIGHT 
IG DoD Followup Review. August 31. 2009 

We have monitored DCAA’s efforts to correct the deficiencies noted in our 
May 2007 peer review, and we conducted a significant review in response to the 
July 22, 2008, GAO report. Our audit report entitled “Follow-up Review on Audit 
Work Deficiencies and Abusive Work Environment Identified by the Government 
Accountability Office Report” (D-2009-6-009) was issued on August 31, 2009, to 
address findings in the GAO report. 

We reviewed DCAA audit documentation for 1 3 cases and interviewed 
auditors for 12 cases. When available, we also reviewed the current audits DCAA 
performed to correct the deficient audits identified by GAO. We visited two 
DCAA Western Region field audit offices and interviewed 68 audit employees, 
including supervisors and managers, to assess whether an abusive work 
environment existed. 
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Some of our more significant findings included: 

1 . Employee concerns with time pressures, uncompensated overtime, 
changes to audit results and opinions, and unprofessional behavior 
created a work environment not conducive to performing quality 
audits at two DCAA offices in the Western Region. 

2. A flawed audit could have allowed a contractor to recover 
$271 million in unallowable costs on the Evolved Expendable 
Launch Vehicle (EEL V) program. Of the $271 million, $101 
million has been paid to date. In our October 20, 2008, 
Memorandum to Commander, Air Force Space and Missile Systems 
Center, and Director, DCMA, we recommended SMC take 
immediate action to withhold any further payments from the EELV 
joint venture for unabsorbed Program Management and Support 
costs, immediately cease negotiations on a $1 14 million proposal 
containing these same unallowable costs, and reassess the propriety 
of existing advance agreements between SMC, DCMA and the 
contractor. 

3. DCAA provided ineffective audit advice and services to a 
contracting officer and DCAA had insufficient evidence to support a 
contractor’s participation in the direct bill program. 

4. Seventeen of 18 forward pricing audits performed by trainee auditors 
at a third Western Region office did not comply with standards. 

5. DCAA did not adequately qualify the audit results of a 
compensation system report and had insufficient evidence to support 
a purchasing system audit opinion. 

6. DCAA did not have sufficient basis for dropping four findings, and 
did not report a contractor’s uncompensated overtime practice which 
increased the risk of cost mischarging. 

On the basis of these findings, we recommended that: 

1 . DCAA rescind five audit reports and notify contracting officials not 
to place reliance on the reports’ conclusions. 

2. DCAA address management actions and behaviors that have a 
negative impact on the work environment. 

3. DCAA create a mechanism for reporting external impairments to 
auditor independence in the DCAA Contract Audit Manual. 
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4. The Commander, Air Force Space and Missiles Systems Center, 
withhold future payments for certain unallowable costs on the 
affected contract 

5. The Executive Director, Contracts, Defense Contract Management 
Agency, reassess the identified advance agreements pending receipt 
of newly initiated DCAA audits. 

Our report also recommended that DCAA take “appropriate corrective 
action” regarding the performance of the two supervisors associated with nine of 
the thirteen cases of the non-compliant audits reviewed. DCAA has reported that 
the two supervisors will re-take supervisory courses at the Defense Contract Audit 
Institute, and their managers will identify other appropriate training activities. 
Legal review by DCAA determined that adjustments to prior performance ratings 
would not be appropriate. 

DCAA concurred with 23 of our 24 recommendations and reserved 
comment on one other recommendation. We requested that the DCAA reconsider 
its position on the recommendation to rescind DCAA Audit Report No. 4461- 
2006A2 10000001, and comment on it in response to our final report. We also 
requested that DCAA reconsider its responses to three recommendations which 
did not meet the intent of the recommendations, and to provide comment on one 
recommendation we added. 

The Air Force Space and Missile Systems Center concurred with our 
recommendations as did the Defense Contract Management Agency. 

We will continue to monitor DCAA actions regarding our 
recommendations. 
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Senior Official Investigations 

My office conducted a senior official investigation and concluded that the 
former Regional Audit Manager with responsibility for DCAA’s Resident Office 
at Boeing, Huntington Beach, California, was not free from external impairments 
to independence as required by GAGAS and DCAA audit policy. Her direction 
resulted in a flawed audit that could have allowed Boeing to recover $271 million 
in unallowable costs. Additionally, we received allegations that she created an 
abusive working enviromnent. 

Because this Regional Audit Manager was promoted to Deputy Director, 
Western Region, DCAA, the allegations were addressed in a senior official 
investigation that resulted in a report issued September 1 1 , 2009. The 
investigation concluded that the individual failed to meet GAGAS standards for 
independence and objectivity by improperly directing changes to the audit report 
and that she engaged in conduct that was inconsistent with established leadership 
standards for senior officials. The report was provided to the Director, DCAA, for 
review and appropriate action. 

We also conducted separate investigations into allegations that two other 
DCAA senior officials abused their authority by improperly directing changes to 
audit opinions. Those allegations were not substantiated. 
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Expiration of 2007 Peer Review Opinion 

Based on the recent review of DCAA by GAO together with deficiencies 
indentified in our May 2007 peer review, I took the extraordinary action of 
notifying DCAA that our May 2007 “adequate” opinion on DCAA’s system of 
quality control would expire as of August 26, 2009. On the basis of our action, I 
recommended that DCAA immediately begin to qualify its audits with a statement 
noting an exception to compliance with the Quality Control and Assurance 
Standard. Additionally, I recommended that DCAA publicly disclose the concerns 
of the GAO, including the questioning of the reliability of audit reports issued 
during the period ending September 30, 2006. 

2009 Peer Review 

The peer review of DCAA for the period ending September 30, 2009, was 
announced on August 5, 2009, and will be performed in three or four projects. We 
will assess whether DCAA’s quality control system provides reasonable assurance 
of compliance with standards in design and effective operation and compliance in 
practice. The review will follow up on various DCAA corrective actions in 
response to GAO and DoD IG findings and will also consider repeated non- 
compliances with government auditing standards identified in our May 2007 and 
December 2003 opinion reports on the DCAA quality control system. 

Additionally, when planning our review, we will take into consideration 
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deficiencies found by GAO in its July 2008 report and the report it is releasing 
today. 

On September 1, 2009, DCAA sent a request to GAO to delay the 
announced peer review by at least two years to be able to continue its internal 
improvements to address previously noted deficiencies. I am not convinced that 
this is the right strategy at this time. Whether or not the peer review is delayed, 
the DoD IG continues to have a statutory responsibility to provide audit oversight. 
In the event the peer review is postponed, we would undertake a number of 
targeted reviews of DCAA high risk areas. 

Hotline Complaints - Whistleblower Protection 

Since the hearing last September, the Defense Hotline has continued to 
receive allegations of misconduct at DCAA. At this time we have 36 open Hotline 
complaints involving DCAA. Of those, 14 complaints concern potentially 
inappropriate contractor practices and have been referred to either DCAA or to the 
Defense Criminal Investigative Service. The 22 remaining cases include 
allegations such as changing findings and scope of audits, noncompliance with 
standards, lack of audit independence, and management abuses.' We are 
diligently pursuing these allegations and will take into consideration relevant 


' Two cases involve allegations of inappropriate action by DCAA personnel. The allegations do not relate 
to audit quality or overall management issues and have been referred to DCAA for review. 
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Hotline complaints as part of our risk assessment of DCAA for the peer review, or 
for other high risk assessment projects. 

A concern raised at the hearing last September was how the DoD IG 
protects the identity of whistleblowers who wish to remain confidential. 
Whistleblowers are critical sources of information to Inspectors General and it is 
vital that we protect their identities to the greatest extent possible. We have 
conducted a comprehensive review of the Defense Hotline and as a result have 
issued new Hotline operating procedures that implement several steps to improve 
our processes. One such step was to revise the warning statement that 
accompanies all Hotline documents to emphasize that access to Hotline 
information is limited to those responsible for responding to the DoD IG. This is 
intended to ensure information that may include the identity of a complainant is 
not provided to those without a need to know. Additionally, we have implemented 
additional checks to ensure that we identify if a complainant has consented to the 
release of his or her identity. We are also reviewing cases more closely to 
determine if referral to another agency could place a complainant at greater risk of 
reprisal, or should instead be retained by the DoD IG for investigation. 

Conclusion 

In closing, I emphasize the importance of the mission of DCAA and its 
impact on the Department of Defense. I am dedicated to helping improve DCAA 
operations. Our oversight role is essential to helping DCAA identify weaknesses 
and where problem areas exist. 

I welcome your questions. 
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Statement of The Honorable Robert F. Hale 
Under Secretary of Defense (Comptroller) 

Committee on Homeland Security and Governmental Affairs 
United States Senate 
September 23, 2009 

Mr. Chairman, thank you for the opportunity to share a few observations 
concerning the Defense Contract Audit Agency (DCAA). I will focus on the 
concerns raised by the recent Government Accountability Office (GAO) 
report regarding DCAA. 

As Members of this Committee are aware, the Department of Defense has 
submitted a lengthy response to GAO’s recommendations. We acknowledge 
the seriousness of GAO’s findings and concur with their recommendations 
with very few exceptions, some of which I will explain below. Based on my 
review of DCAA and the GAO recommendations, I believe that DCAA, 
with assistance from DoD, needs to focus on three major issues: 

• Improving the quality of audits, especially the approach to auditing 
contractor business systems. 

• Assessing the number and types of audits performed by DCAA and 
whether all audits currently required by acquisition laws and 
regulations are appropriate. 

• Assessing improvements in the process for resolving DCAA audit 
results to ensure the audit findings are fully considered during 
contracting officer deliberations. 

DCAA has already begun to focus on these major issues and others. It is 
important to note that the audit assignments covered by GAO’s review were 
completed three to five years ago and that a series of corrective actions was 
undertaken beginning in late 2008. In her testimony, the DCAA Director 
will describe the actions that have already been completed and those that are 
even now being implemented. The Committee should understand that it 
may take several years for the full benefit of these actions to be realized. 

In addition, I would like the Members to know that the Office of the Under 
Secretary (Comptroller) has taken steps to improve oversight of DCAA 
operations, and we continue to monitor DCAA to ensure timely 
implementation of GAO’s recommendations. 
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To assist with this monitoring, I established a DCAA Oversight Committee 
last March that provides my office with advice and recommendations 
concerning oversight of DCAA. The committee is made up of the Auditors 
General of the Army, Navy, and Air Force; the Director of Defense 
Procurement and Acquisition Policy (DPAP); and the DoD Deputy General 
Counsel for Acquisition and Technology. This senior group will assess 
DCAA’s activities and the actions taken to correct problems identified by 
GAO and others. The oversight committee meets regularly, and I have met 
with them several times. I have also assigned a member of my senior staff to 
assist in these oversight efforts. 

We have also taken steps to increase the resources available to DCAA: 

• Between Fiscal Years 200 1 and 20 1 0, the budget for DCAA has 
increased from $331.6 million to $458.3 million, growth of 38.2 
percent. 

• DCAA’s total staff will increase by 1 3 1 (or 3.2 percent) over this 
same period. 

• DCAA is considering whether increasing DCAA staff by 700 auditor 
positions by the end of FY 2011 is a high budgetary priority, to be 
paid by the Defense Acquisition Workforce Development Fund. 

We believe that — by taking aggressive action, improving oversight, and 
increasing resources -- we can resolve the significant issues posed by the 
GAO report. We will monitor progress to determine if further actions need 
to be taken. 

In two areas, however, we take issue with GAO’s conclusions. These are 
considerations that GAO offered to Congress. 

First, GAO suggested that Congress consider providing DCAA with 
independence similar to that of the Department’s Inspector General (IG). 

We respectfully disagree. We do not believe that the DCAA Director should 
be a Senate-confirmed position unless DCAA is independent of DoD. 
Presidential appointment with Senate confirmation will inject an 
inappropriate political element into DCAA, and it will inevitably create 
lengthy periods when there would be no Director. 

Likewise, we oppose fixed terms for the DCAA Director. If DCAA remains 
part of DoD, the Secretary of Defense must have the ability to choose an 
appropriate Director. We also question the wisdom of an independent 
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budget, which would prevent or limit our ability to move money into 
DCAA, as is occurring now with funding from the Defense Acquisition 
Workforce Development Fund, Nor do we support mandatory public 
reporting, an additional burden on an agency that is already working hard to 
meet its many mission demands. 

While we do not support IG-like independence, we are taking steps to 
strengthen DCAA’s independence internally by assessing improvements to 
the process used by contracting officials to resolve DCAA audit findings. 
Under this process, for highly significant issues, DCAA may appeal to the 
Director of DPAP. If DCAA disagrees with the DPAP decision, further 
appeal could be made to the Under Secretary (Acquisition, Technology, and 
Logistics) and to the Under Secretary of Defense (Comptroller), who would 
act together as a team. We expect that appeals to the Under Secretary level 
would involve only the most important issues. 

Secondly, GAO suggested that Congress require DCAA to report to the 
Deputy Secretary of Defense. DoD strongly disagrees with this 
recommendation. The Deputy Secretary is the Chief Management Officer of 
one of the world’s largest organizations and backs up the Secretary in the 
wartime chain of command. Adding direct oversight of an individual 
Defense agency would add unreasonably to his current responsibilities. 
Accordingly, at least until the issues related to GAO are resolved, we 
recommend that DCAA continue to report to the USD(C). 

In sum, Mr. Chairman, we acknowledge that GAO has raised some serious 
issues. We believe that we have begun taking the appropriate steps to 
resolve those issues and will monitor the situation to determine if additional 
steps are needed. 

Lastly, as we go forward it is also essential that we keep in mind the value of 
the services DCAA provides to DoD and other organizations. I have spoken 
personally to the Director of DPAP - one of DCAA’s key customers - and 
he informed me that DCAA products are necessary and critical to the 
acquisition process. The Wartime Commission on Contracting has made 
similar comments. As we strive to resolve issues raised by GAO, we must 
be careful not to undermine the unique value of DCAA. 

Mr. Chairman, thank you again for providing this opportunity for me to 
comment on the GAO findings. I am convinced that working together we 
can ensure that the work of DCAA will continue to support the Department 
of Defense and the security of the United States. 
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Testimony 

of 

April G. Stephenson 

Director, Defense Contract Audit Agency 

Mr. Chairman, members of the Committee, thank you for the opportunity to appear before 
you today; I am pleased to be here. 

As requested, I will describe the actions taken by the Defense Contract Audit Agency 
(DCAA), as a result of two reports issued by the Government Accountability Office (GAO): 

(I) the July 2008 GAO Report regarding allegations that certain DCAA audits did not meet 
professional standards {DCAA Audits: Allegations that Certain Audits at Three Locations Did 
Not Meet Professional Standards Were Substantiated) and (2) the report issued most recently 
covering audits of contractor internal controls and related audits. 

Please be assured that we have taken the GAO’s findings very seriously. We have worked 
diligently since late 2008 to accomplish a number of actions to improve the quality of the audit 
services and to improve the working environment for our employees. As shown in the Appendix 
of the submitted testimony and as discussed with Committee staff members throughout the year, 
we have completed over 50 specific improvement actions. We are not done yet and have various 
long-term actions in place that we will accomplish in FY 2010 and several years thereafter. 

Background on DCAA 

Mr. Chairman, the DCAA is a distinct agency of the Department of Defense (DoD) that 
reports to the Under Secretary of Defense (Comptroller). The DCAA mission is to perform all 
necessary contract audits for DoD components responsible for the negotiation, administration, 
and settlement of contracts and subcontracts. In total, the DCAA has about 4,200 employees and 
1 04 field audit offices. 
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In FY 2008, the DCAA performed 30,352 audits covering $501 billion in proposed or 
claimed contractor costs. These audits recommended reductions in proposed or billed costs of 
$17.9 billion (referred to as questioned costs), and $7.2 billion in estimated costs where the 
contractor did not provide sufficient information to explain the basis of the estimated amounts 
(referred to as unsupported costs). 

In total, the DCAA has about 4,200 employees and 104 field audit offices. 

As you may know, the DoD Inspector General (IG) is responsible for the oversight of 
DCAA’s quality control system, and the IG has previously determined both that DCAA’s system 
of quality control is designed in accordance with Government Auditing Standards, and that the 
quality control system being used on audits is adequate. In August 2009, the IG notified DCAA 
that the prior “peer review” had expired and as a result, the expired “peer review” is mentioned 
in all audit reports issued after the notification, as well as a posting on the DCAA public web 
site. 


GAO Report Findings and Root Causes 

For purposes of my testimony today, Mr. Chairman, we have categorized the GAO’s 
findings from both the July 2008 investigation and the most recent audit into four general areas: 
Insufficient Testing of Contractor Internal Controls; Ineffective Quality Assurance Program; 
Lack of Independence; and Management Abuses of Employees and Impediments to the 
2008 GAO Investigation. 
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Insufficient Testing of Contractor Internal Controls 

In its recent review, the GAO identified noncompliances with the auditing standards for 
nearly all the assignments it reviewed. The assignments covered 2004 to 2006, several years 
prior to the implementation of the many improvements we accomplished over the last year. One 
of the primary deficiencies involves the amount of transaction testing that is performed in audits 
that provide an opinion on contractors’ internal control systems. The GAO has concluded that 
DCAA has not performed sufficient transaction testing to provide an opinion of “adequate.” 

Contractor internal control systems involve hundreds of “control points.” Auditors assessed 
the risk of the control points on Government contracts and established the level of testing based 
on that risk. When the auditors determined that the risk was low, fewer control points were 
tested. When the risk was higher, more control points were tested and at a greater depth. The 
GAO did not agree with our policy on transaction testing and consequently concluded the audit 
work was deficient. In some instances, auditors permitted prior metrics and internal due dates to 
inappropriately reduce the level of testing performed in audits. 

We recognize the GAO’s concerns and initiated a project in 2009 to reassess the manner in 
which DCAA tests contractor business systems. Although the auditing standards do not require 
that DCAA express an opinion on the adequacy of the contractors’ internal control systems, we 
did so to provide contracting officials meaningful information to approve or disapprove a 
contractor’s system as stipulated under the Federal Acquisition Regulations. We are currently 
assessing the type of systems DCAA will need to audit and the type of opinion to be provided. 
We will continue to seek advice from the GAO and the DOD Inspector General. We anticipate 
our revised processes will be tested in early FY 2010 starting with the contractor’s system for 
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preparing interim and final billings to the Government. We envision the revised processes will 
consolidate testing of contractor billings currently performed in three different types of audits 
into a single audit. 

As stated at the hearing last year, after the OAO issued the investigation in July 2008, we 
initiated an assessment of the performance metrics. At the end of September 2008, we 
completely revamped our performance measures and the process for applying the measures. We 
eliminated 18 metrics that focused on productivity and hours per audit and implemented 8 new 
measures. The new measures emphasize audit quality and timeliness in terms of requestors’ due 
dates and not a standard DCAA cycle time. The measures apply at the Agency level rather than 
at the field audit office or auditor level as had been done in prior years at some locations. 
Feedback from focus groups from across the Agency have been favorable on the new measures. 

Ineffective Quality Assurance Program 

The OAO concluded that DCAA’s Quality Assurance program was deficient and as a result 
the risk of assignments that did not comply with the auditing standards is increased. After the 
OAO’s issuance of the investigative report in July 2008, we recognized that improvements were 
required not only with the structure of the quality assurance organization, but the manner that we 
conducted the quality assurance reviews. In August 2008, we centralized the quality assurance 
function by moving it to Headquarters and reassigned all quality assurance employees to the new 
Headquarters directorate. However, centralizing the functions was not enough. We also 
changed the maimer in which we performed the quality assurance reviews. 

We more than doubled the number of assignments reviewed for each office. We no longer 
provide a rating of pass or fail that was dependent on the number of deficient assignments. 
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Rather, any field audit offices that are determined to have at least one assignment not in 
compliance with the auditing standards would be required to provide a meaningful corrective 
action plan. Conective actions are monitored at the Headquarters level and not the regional level 
as in prior years. Moreover, all offices are reviewed on a three-year cycle, and all types of 
assignments are included in the sample universe. Performing quality assurance reviews is a full- 
time commitment of the quality assurance organization, and no other projects are undertaken, as 
had been done in prior years when the quality assurance function was at the regional level. 

Lack of Independence 

In its most recent review, the GAO concluded that DCAA lacked independence in seven 
assignments. The reason for the lack of independence in the recent review is somewhat 
different than the root cause discussed in the July 2008 investigative report. The root cause that 
led to the GAO’s conclusion in July 2008 was DCAA*s participation in Integrated Product 
Teams (IPTs). IPTs were established by DoD in the mid-1 990s as a means of expediting the 
assessment of contractor bid proposals and the resolution of outstanding issues. DCAA 
discontinued participation in IPTs in August 2008. 

In its recent review, the GAO concluded that DCAA’s independence was impaired 
primarily due to auditors providing input on draft corrections to internal control policies and 
procedures and then auditing the final policies and procedures. In several instances, the auditors 
issued a no-exception audit report when the contractor corrected the deficiencies during the 
audit. It is not uncommon for contractors with system deficiencies to seek input from the 
auditors while they are developing corrections to the systems. In many instances, providing 
feedback throughout the processes expedites the correction of the deficiencies. However, the 
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GAO has concluded that this “feedback” impairs the auditors’ objectivity as they will audit 
information that they have provided feedback on prior to implementation. We have corrected 
both of these issues. Auditors no longer provide feedback to contractors on draft corrections to 
systems and no longer remove deficiencies from audit reports when the deficiencies are 
corrected during the audit. 

Management Abuses and Impediments to the GAO’s 2008 Investigation 

In the July 2008 investigation, the GAO concluded that DCAA had an abusive work 
environment and that there existed a pattern of frequent management actions that served to 
intimidate some of the auditors and create an abusive environment at two of the three locations 
covered by its investigation. The GAO stated that its conclusions were based on confidential 
interviews and e-mail documentation. In its recent review, the GAO did not report any specific 
instances of abusive behaviors by DCAA management. 

Since the GAO did not provide specific information upon which any personnel action 
could be taken In July 2008, we requested the services of the DoD Inspector General to 
investigate the matter. The Inspector General completed its review in August 2009 and although 
the IG did not go so far as to state that DCAA had an abusive work environment, it concluded 
that two offices it reviewed did not have a work environment conducive to producing quality 
audits. 


The DOD Inspector General reported that in one office, employees felt pressure to work 
uncompensated overtime (an average of about 7 hours per pay period). In a second office, the IG 
reported several employees had yelled or raised their voices in the office. We believe both of 
these issues have been adequately addressed, and the DoD IG concurs. 
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On the issue of impediments to the GAO’s investigation, the DoD IG did not identify any 
attempts by DCAA to impede the investigation other than a letter written in August 2007 to one 
of the senior auditors. As was discussed in the hearing last September, the letter was prepared by 
one of the Defense Legal Services attorneys assigned to DCAA. The letter was rescinded the 
day after the hearing last year. Aside from the August 2007 letter, the DOD IG did not identify 
any other impediments to the GAO’s investigation. 

To provide employees an opportunity to report instances of perceived management abuse 
without fear of retaliation, we launched an anonymous web site in September 2008. The web 
site is treated as a hotline, and allegations are either investigated by a DCAA internal 
ombudsman team established in late 2008 or referred to the DoD IG hotline for investigation. 

For example, allegations involving a member of the Senior Executive Service are automatically 
referred to the DoD IG for investigation per DoD policy. 

The ombudsman program is very active and prioritizes the investigations and reporting 
depending on the severity of the allegation. Issues of abusive management are top priorities for 
the team. 


DCAA Actions 

Mr. Chairman, as a result of the 2008 GAO investigation and the most recent review, we 
have taken a number of actions. The Appendix to my submitted testimony contains a list of 
actions completed to date, as well as actions that are in process as of today. In addition, 1 would 
like to discuss some of the more significant actions at this time. 
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structure 

1 . With regard to the organizational structure of DCAA, we completed a bottoms-up staffing 
assessment, including an assessment of staffing for the quality assurance function, to determine 
whether we have the appropriate staffing at all levels of the organization. Staffing shortfalls 
were provided to the DoD Comptroller in September 2008 and discussed throughout FY 2009. 

We submitted a proposal to DoD under the Defense Acquisition Workforce Development 
Fund in December 2008 and received funding in March, April, and August 2009. We were 
approved to hire 300 new auditor trainees in FY 2009, and 200 in FY 201 0. We have tentative 
approval for 200 in 201 1 depending on budget priorities, for a total of 700 new trainees by the 
end of FY 201 1 . We have met our hiring goal in FY 2009 and anticipate easily meeting the 
hiring goals in FY 2010 and 2011. 

Although the increase in trainees is a good start toward improving our staffing situation, we 
will continue to work with the Department on how best to address future staffing needs. 

2. We added 25 new field audit offices increasing from 79 offices in August 2008 to 104 offices 
in August 2009. This equates to an additional 25 field office managers and a number of new 
supervisory positions. We reduced the span of control for managers and supervisors to provide 
greater training to the new employees as well as to ensure appropriate oversight of audit quality. 

3. As stated earlier, we completely revamped the quality assurance organization. We changed 
the maimer in which the reviews are performed and greatly expanded the number of reviews 
conducted at each office every year. 
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Culture 

1 . With regard to the culture of DCAA , we completely revised the performance measure 
process. As stated earlier, we eliminated 1 8 measures and implemented 8 new measures to focus 
on audit quality. We held focus groups in FY 2009, and feedback was favorable as most 
employees reported that they did not feel pressure to meet the performance measures on 
individual assignments. 

However, although budget hours on individual assignments is not considered a 
performance measure, many auditors felt pressure to meet initial budget hours and did not feel 
they could request an extension. As a result, we removed the requirement to meet budget hours 
from the performance standards and inserted new language on the requirement to complete 
audits in accordance with the auditing standards. We also conducted a review within each of the 
regions to ensure that performance actions were not being taken based solely on not meeting 
initial budget hours. 

2. We hired the Center for Defense Management Reform at the Naval Postgraduate School, to 
assist with cultural transformation across the Agency. This is a long-term action that will be 
completed over three to five years and may continue thereafter. With the Center’s assistance, we 
identified four major projects to address in FY 2010. These projects will answer the following 
questions: 


a. How can DCAA put people first to guide its decisions, actions and values? For 
example, an increased emphasis on “soft skills” such as building morale and developing 
employees (in terms of broad understanding as well as technical proficiency). 
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b. How can DCAA develop leaders to serve the employees and the organization? 

c. How can DCAA structure the organization to facilitate compliance with Generally 
Accepted Government Auditing Standards; maximize audit results; and better align 
agency workload and resources? 

d. How can DCAA identify and resolve differing expectations between contracting 
officers; contractors; the public (Congress); and external review organizations? 

3. As mentioned earlier, we ceased participation in IPTs to avoid the appearance of a lack of 
independence. We also ceased participation in Source Selection Evaluation Boards. We no 
longer provide feedback to contractors during audits and will report deficiencies discovered 
during an audit even when the deficiencies are corrected prior to report issuance. 

4. We established an anonymous web site and ombudsman program for employees to report 
inappropriate actions by management or other employees. We have assigned a dedicated team to 
the ombudsman function in the Agency. 

5. I established a Senior Advisory Council for Improvement which I chair, to oversee the 
implementation of improvements as a result of recommendations from various external reviews. 

Processes 

Finally, to address the improvements in processes: 
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1. We instituted a revised process for determining the audit requirements for FY 2010. Based 
on the audits required under laws and regulations and an estimate of the audits required to meet 
contracting officials’ demand requests, the field audit offices developed the hours necessary to 
accomplish the workload, taking into consideration the risk of the various contractors, the skill 
level of the audit staff and an estimate of the additional hours required to comply with the 
auditing standards. Based on the hours, we developed Agency-wide priorities. Since our 
funding provides for only about 65% of the audits that are required to be completed, we based 
the FY 2010 priorities on the audits of highest risk. This process is consistent with the GAO’s 
recommendation of performing a risk based approach to auditing rather than “production line” 
auditing. 

For example, all war-related effort in-theatre; requests for audits of contractor bid proposals prior 
to awarding of a contract; and billing and accounting system audits at the largest contractors. 

We engaged the Army Force Management Support Agency to evaluate DCAA’s process for 
planning FY 2010 audit needs as well as our staffing requirements. This effort is expected to be 
completed in October 2009. 

2. We are in the process of improving the development and delivery of what is referred to as 
“life-cycle” training. The goal is to provide necessary training throughout the career of the staff, 
including auditors, management, and support staff. 

3. We provided training to all DCAA employees on quality audits and the DCAA work 
environment in August during quality stand-down days. The discussion focused on barriers, 
actual or perceived, to performing quality audits and processes needed to remove the barriers. 
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4. We revised guidance on reporting unsatisfactory conduct of government officials when there 
has been a flagrant disregard for acquisition rules and regulations. The prior processes involved 
elevating the issue to the official’s chain of command. The new process involves reporting the 
issue to the DoD IG for investigation when the chain of command has not resolved the issue to 
DCAA’s satisfaction. 

5. The Administration is considering whether it would make sense legislatively to expand the 
DCAA subpoena authority to be similar to the subpoena authority provided to the DoD IG. 
Under the proposal, DCAA would be provided access to the contractor accounting records and 
other information necessary to accomplish the contract audit function. 

6. We continue to work with the Under Secretary Comptroller and Under Secretary for 
Acquisition, Technology, and Logistics, on an improved process for resolution of DCAA audit 
findings. 

Closing 

In closing, Mr. Chairman, I want to underscore the seriousness with which DCAA is taking 
this matter. Inadequate work is unacceptable, and disciplinary and personnel actions will be 
taken as appropriate. As 1 have indicated, a number of steps to resolve these issues have already 
been taken and completed. Others are in process, but DCAA is committed to ensuring that the 
agency is above reproach, that all of its audits are performed in accordance with auditing 
standards, and that its culture promotes the kind of vigilance and quality that protects the 
interests of the American taxpayers. 

Mr. Chairman, thank you again for the opportunity to address the committee. 1 am happy to 
answer your questions. 
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Appendix to Written Statement of Ms. April G. Stephenson 
Senate Committee on Homeland Security and Governmental Affairs 
Specific DCAA Actions in Response To The GAO Reports 


Structure 

• Approved agency-wide reduction in supervisory span of control (June 2008). 

• Approved 25 new field audit offices and 5 new Regional Audit Managers lowering the 
span of control (May - February 2009). 

• Completed Agency-wide staffing assessment and requested staffing increase to 
Comptroller on September 10, 2008. Updates on staffing shortfalls were provided to the 
Comptroller at regular intervals throughout FY 2009. 

• Realigned Quality Assurance to report directly to the Deputy Director (August 2008) 

o Submitted request to OSD for SES level position for the Integrity and Quality 
Assurance (QA) function (September 2008). Request was initially denied by 
DoD in January 2009 and the position was filled at the GS-1 5 level. However, 
after another attempt by the Director for a SES position, DCAA received approval 
in July 2009 and a job announcement was issued shortly thereafter, 
o Expanded the next round of QA reviews, 
o Revised process for tracking and following-up on QA findings, 
o Revised process for next 3-year cycle to ensure all audit offices are covered, after 
consultation with the DoD IG . 
o Completed assessment on level of QA staffing. 

o Issued revised comprehensive instruction on DCAA’s QA program (December 
2008). 

• Submitted request for funds under Section 852 acquisition workforce fund in December 
2008. Under the Defense Acquisition Workforce Development Fund, DCAA has 
received $17.2 million to date (allotments in March, April, and August). 

o DCAA brought on-board 245 new interns by the end of July and have many offers 
with on-board dates in late FY 2009. As a result, DCAA will easily meet the goal 
of 300 by the end of September and will probably exceed it. 

• Realigned all Financial Liaison Advisors from the Field Detachment region (region that 
handles all Top Secret audits) to Headquarters to avoid the appearance of a lack of 
independence. As of November 2008, all Financial Liaison Advisors report directly to 
Headquarters. 

• At the request of the Director, the DCAA point of contact for the Office of Special 
Counsel investigation was moved from the DCAA General Counsel to the DoD General 
Counsel’s office due to the investigation being expanded. 
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Culture 

• Revised policy for resolving difference in audit results and opinions - elevate within 
management structure from two to four levels (July 2008). 

• Ceased participation as members of Integrated Product Teams (IPTs) to avoid the 
appearance of a lack of independence (August 2008). 

• Revised performance measures - eliminated 1 8 measures and added 8 measures 
(September 2008), 

• Established web site for employees to anonymously voice concerns about the 
inappropriate use of performance measures and other inappropriate actions (September 
2008). 

• Engaged OPM to conduct an organizational assessment survey and are assessing results 
of the survey conducted by OPM - the working group is evaluating results and 
developing actions. 

• Ceased participation as members of Source Selection Evaluation Boards to avoid the 
appearance of a lack of independence - requested audits will still be provided (November 
2008). 

• Director/Deputy Director staff presentations emphasize the need to perform quality audits 
and discuss performance measures (various presentations through 2008 and 2009), 

• Established a Senior Advisory Council for Improvement chaired by the Director to 
oversee the implementation of improvements as a result of the Defense Business Board 
recommendations (report issued January 22, 2009). 

• Issued several memorandums reiterating the importance of cooperating with GAO, IG 
and other reviewers/investigators, 

• Held stand down day for audit quality at all DCAA locations (August /September 2008 
and again in August 2009). 

• Completed armual independence training (September 2008 and September 2009). 

• Held focus groups to obtain feedback on implementation of performance measures issued 
in September 2008 which revealed minimal problems with implementation of new 
measures (February /March 2009), 

• The Director required all regions to assess whether exceeding budget hours on individual 
assignments was inappropriately used to lower performance ratings. The regions 
completed the assessments and implemented corrective actions (December 2008). 

• Established new process to obtain input regarding the new hire employment experience 
and to identify reasons why employees leave DCAA (November 2008). 

• Revised job objectives/performance plans for the 0511 (auditor) positions to eliminate the 
language on meeting audit budget hours and productivity measures and added language 
strengthening the need to execute audits in accordance with the auditing standards and 
Agency policy (February 2009). 

• Revised supervisory development curriculum based on feedback from focus groups and 
other feedback mechanisms to emphasize leadership skills and the more common day-to- 
day activities which supervisors perform (April 2009). 
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Processes 

• Issued memorandum on adequate working paper documentation (July 2008). 

• Completed Agency-wide assessment to determine whether GAO’s findings are systemic 
across DCAA. Six of the forty assignments reviewed contained noncompliances. 

Actions being taken to address issues (September 2008). 

• Raised the field audit office signature authority for all audit reports to the level of the 
manager or higher (August 2008). 

• Revised policy for the monthly quality review of issued audit reports from regions to the 
Headquarters Quality Assurance division (October 2008). 

• Revised DCAA Quality Checklist for Review of Audit Working Papers (checklist is used 
by auditors and supervisors prior to report issuance) (December 2008). 

• Issued guidance clarifying DCAA’s process for pursuing access to contractor records and 
initiating a subpoena (December 2008). 

• Issued clarifying guidance on what constitutes a significant deficiency in contractor 
internal control systems (December 2008). 

• Revised policy on reporting results of the review of contractor systems and related 
internal controls to eliminate the inadequate in-part opinion so that the overall opinion on 
the system is either adequate or inadequate (December 2008) 

• Issued guidance on performing and reporting on limited scope internal control audits 
(December 2008) 

• Issued guidance reminding auditors to report suspected contractor fraud and other 
irregularities encountered during the audit and emphasized that managers do not approve 
the Form 2000, but rather review it for clarity (February 2009). 

• Issued guidance on documentation of judgmental sampling (February 2009). 

• Revised guidance for reporting unsatisfactory conditions related to actions of 
Government officials wherein certain unsatisfactory conditions will be reported directly 
to the DODIG in lieu of reporting the conditions to a higher level of management 
(March 2009). 

• Issued guidance clarifying requirements for contractor eligibility to participate in the 
Direct Bill Program (April 2009). 

• Issued guidance to remove major contractors from direct billing where contractor has 
implemented a new billing system or accounting system that significantly impacts 
Government billings and the new system has not been examined (April 2009). 

• Revised a self study training course (CMTL 1326) to include new guidance on 
identifying key elements of an effective internal control audit report and the requirements 
for issuing a real-time (flash) report (May 2009). 

• Issued an audit alert emphasizing existing guidance which requires that a separate Cost 
Accounting Standards noncompliance audit report will be issued when a noncompliance 
is found during any audit (June 2009) 

• Issued an audit alert to clarify that forward pricing due dates should be based on the 
realistic assessment of risk factors for each specific contractor and proposal under review 
(June 2009). 

• Issued guidance on contract audit closing statement reviews in July (after receipt of DOD 
IG comments). This completes the last action item from the peer review. 


3 


Appendix 


VerDate Nov 24 2008 


13:37 Apr 18, 2011 Jkt 053841 


PO 00000 Frm 00087 Fmt 6601 


Sfmt 6601 


P:\DOCS\53841.TXT SAFFAIRS PsN: PAT 



84 


• Instituted a revised process of determining audit requirements for FY 2010. Developed 
Agency-wide audit priorities. Current budget for FY 2010 only covers about 65% of 
requirements - audits planned for FY 2010 based on higher risk assignments with lower 
risk assignments deferred to FY 201 1 (backlog of audits growing each year since war 
effort) (September 2009). 

• Submitted a legislative proposal expanding DCAA access to contractor information 
similar to the authority provided the DOD IG (September 2009). 


Long-Term Planned Actions 

• Obtained the services of the Naval Postgraduate School, Center for Defense Management 
Reform to assist with the Agency-wide cultural transformation. The initial effort started 
June 2"“' with the DCAA executive team. As a result, four major initiatives were adopted 
for incorporation in the DCAA Strategic Plan. Teams of executives were assigned to 
each initiative to further develop the milestone plan for executing the objective. The four 
items are: 

1 . How can DCAA put people first to guide its decisions, actions and values? For 
example, an increased emphasis on “soft skills” such as building morale and developing 
employees (in terms of broad understanding as well as technical proficiency). 

2. How can DCAA develop leaders to serve the employees and the organization? 

3. How can DCAA structure the organization to facilitate compliance with GAGAS; 
maximize audit results/ROI; and better align agency workload/resources? 

4. How can DCAA identify and resolve different expectations of contracting officers, 
contractors, the public (Congress), and external review organizations? 

These items will be worked for about the next three years. Once the milestone plan for 
each of the four initiatives is developed, it is envisioned that each objective will have 
various completed actions throughout the next three years. Once the milestone plans are 
developed, the objectives will be communicated to the workforce. 

• Performing a comprehensive assessment and revision to DCAA training by instituting a 
life-cycle training process. Effort started in FY 2008 and will conclude in about three 
years. 

• Conducting a comprehensive organizational assessment (based on Baldrige). Estimated 
completion in FY 2010. 

• Performing a comprehensive review of DCAA’s approach for performing internal control 
audits. Estimated completion of baseline audit opinions in FY 2010. 

o Briefed DOD IG on September S"* - favorable feedback. Proceeding with 
developing plan for pilot testing. 

o Reassessing the “direct billing” program which permits contractor submission of 
interim payment invoices directly to the payment office without DCAA approval. 


4 


Appendix 


VerDate Nov 24 2008 


13:37 Apr 18, 2011 Jkt 053841 


PO 00000 Frm 00088 Fmt 6601 Sfmt 6601 


P:\DOCS\53841.TXT SAFFAIRS PsN: PAT 



85 


VerDate Nov 24 2008 


• Engaged the Army Force Management Support Agency to evaluate DCAA’s process for 
planning FY 2010 audit needs as well as staffing requirements. The effort is expected to 
be completed by the end of September. 

• Revamping the Strategic Plan and Fluman Capital Plan (planned December 2009). 

• Reassessing performance plans to better align standards to work expectations. Effort 
started in FY 2009 and will continue in FY 2010. 

• . Submitting legislative proposal to DoD to expand DCAA’s subpoena authority and 
greater access to contractor records similar to IG authorities. 

Based on advice from GAO, on September 4*', we requested extension to peer review to 
assignments completed in FY 201 1. FY 2010 will be a rebuilding year for audits of contractor 
business systems. 
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Gregory D. Kutz, Managing Director, 

Forensic Audits and Special Investigations 

Responses to Questions 
fi'otn Chairman Joseph I. Liebemian 
Committee on Homeland Security and Governmental Affairs Hearing 
on Defense Contract Audit Agency: Who Is Responsible for Reform? 

September 23, 2009 

1. Based on the testimonies of yourself and the other witnesses about the 
problems at the Defense Contract Audit Agency (DCAA) and the steps Ms. 
Stephenson has taken to address those problems, what are the most pressing 
reforms that you think are still needed at DCAA? 

DCAA has taken several positive steps to address aspects of the independence and 
effectiveness problems we found, but much more needs to be done to address 
fundamental weaknesses in DCAA’s mission, strategic plan, metrics, audit approach, 
and human capital practices, which are the most pressing areas needing reform. 

Some of these fundamental weaknesses require attention at the level of the Under 
Secretary of Defense (Comptroller) and above and cannot be accomplished without 
broad support within the Department of Defense (DOD). A mission statement and 
strategic plan are key elements for guiding cultural reform. DCAA needs to have 
these documents in place to define agency mission, purpose, and culture and provide 
a basis for developing effective performance metrics to measure agency progress in 
achieving strategic goals. Further, to assure that audit conclusions and opinions are 
based on sufficient testing, DOD needs to immediately align the number of audits 
with existing resources. Then, DCAA needs to develop a risk-based approach for 
performing contract audits that would include a determination of (i) specific audit 
requirements, (2) the number and types of audits that would most effectively address 
those requirements, (3) the number of contractors to be audited annually, and 
(4) resources needed to meet annual audit requirements. In addition, DCAA needs to 
revise its contract audit policies and procedures to assure its audits meet 
professional standards and develop and provide training on professional auditing 
standards. We believe that these efforts are the most pressing for DCAA and that 
addressing these fundamental weaknesses requires reform efforts by the DCAA 
Director, the DOD Comptroller, the Secretary of Defense, or a combination of these 
individuals. 

2. In light of the high volume of audits performed by DCAA, one of the major 
recommendations of both GAO and the Defense Business Board is for DCAA 
to move to a more risk-based auditing approach. 

• In practical terms, what would a risk-based approach mean? Are there 
some types of audits that DCAA should focus on that would be more likely 
to prevent contractor overbillings and would prevent fraud? 
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• Do you believe that DCAA has the flexibilities it needs to move to a more 
risk-based approach? If not, what would be needed? 

A risk-based audit approach in DCAA’s environment relates primarily to two matters. 
The first is determining how many and what types of audits and nonaudit 
engagements should be performed and then identifying the specific entities to be 
audited. Second, for each audit engagement performed, auditors fypically assess risk 
in order to determine the nature and extent of testing to be performed. We did not 
perform an assessment of the types of audit procedures that DCAA could focus on to 
prevent overbillings and fraud. However, generally accepted government auditing 
standards (GAGAS)' related to fraud, illegal acts, violations of provisions of contracts 
or grant agreements, and abuse for attestation engagements require auditors to 
design and perform audit steps to obtain reasonable assurance of detecting fraud, 
illegal acts, or violations of provisions of contracts or grant agreements that could 
have a material effect on the subject matter of the engagement or internal control, 
and to be alert to situations or transactions that could indicate abuse. To comply with 
GAGAS, DCAA should include procedures designed to detect such activities in each 
of its attestation engagements. 

DCAA generally has not designed procedures in its various attestation audits to 
detect fraud, and in many cases, auditors ignored red flags that are considered to be 
fraud indicators. As discussed in our report, our analysis of audit workpapers showed 
that DCAA auditors lacked an understanding of fraud indicators associated with 
weak internal controls. For example, although segregation of duties is a key fraud- 
prevention control, in six of the seven audits where workpapers identified 
segregation of duties issues, the auditors did not consider a lack of segregation of 
duties to be a fraud risk. The auditors generally did not look for a compensating 
control or perform additional procedures to determine whether the lack of 
segregation of duties had allowed fraud to occur. For example, only one of the 
accounting system audits we reviewed tested the contractor's accounting system 
access controls. Further, while occurrences of duplicate invoices — another red flag — 
also would increase fraud risk, DCAA’s audit program for testing billing system 
controls does not include specific procedures to test for duplicate contractor 
invoices. Revising DCAA’s audit methodology to include substantive testing rather 
than the current approach of testing one or two transactions and talking to the 
contractor, would greatly increase the potential for identifying any contractor fraud 
that may have occurred. 

We believe DCAA can develop a risk-based audit approach working with experts in 
enterprise risk management and DOD stakeholders. However, DCAA claims that it 
already has a risk-based audit approach in place for fiscal year 2010 that is consistent 
with our recommendation. For example, the DCAA Director’s September 23, 2009, 
written testimony explained that based on the audits required under laws and 


* GAO, Government Auditing Standards: 2003 Revision, GAO-03-673G (Washington, D.C.: June 2003), § 6.15a, 
and Government Auditing Standards: July 2007 Revision, GAO~01~131G (Washington, D.C.: July 2007), § 6.t3a. 
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regulations and an estimate of the audits required to meet contracting officials’ 
demand requests, DCAA field audit offices developed the hours necessary to 
accomplish the workload, taking into consideration the risk of the various 
contractors, the skill level of the audit staff and an estimate of the additional hours 
required to comply with the auditing standards. Based on the estimated audit hours, 
DCAA developed agencywide priorities based on highest risk and determined that 
current funding provides for performing only about 65 percent of the audits that are 
required to be completed, DCAA based the FY 2010 priorities on the audits of highest 
risk. 

While the DCAA’ Director stated that this process is consistent with the GAO’s 
recommendation of performing a risk based approach to auditing rather than 
“production line" auditing, we disagree. Our recommendation stated that DCAA 
should consult with DOD stakeholders and engage outside experts to develop a risk- 
based contract audit approach that identifies resource requirements and focuses on 
performing quality audits that meet generally accepted government auditing 
standards (GAGAS). We found no indications that any risk assessments were done at 
a macro level to re-assess the appropriateness of performing 30,000 engagements 
annually or that audit hours estimates were based on procedures that would support 
sufficient testing. Further, there is no indication that DOD stakeholders or outside 
experts were involved in DCAA’s assessment ’The clear imbalance of requirements 
and resources was, in part, responsible for the production-focused metrics and the 
pervasive finding from our work on insufficient audit testing. 

In implementing our reconunendation related to a risk-based audit approach, DCAA 
and its stakeholders in the DOD contracting and finance communities should take 
steps to better align DCAA’s available resources with audit requirements. For 
example, matters to consider include the materiality of contract dollars by 
contractor, specific risks identified for individual contractors, and potential 
reassignment of nonaudit work (e.g., voucher reviews to the Defense Finance and 
Accounting Service, eliminating less significant requirements, and combining other 
requirements into fewer audits. At the individual engagement level, the risk-based 
approach should be designed to require the use of statistical sampling or other 
representative testing at the areas with the highest risk and significance. As discussed 
in our report, the lack of a risk-based approach constitutes a fiindamental weakness 
for DCAA and would require support and leadership from other entities within DOD 
including the acquisition community and the DOD Comptroller to successfully 
address. 

3. In Ms. Stephenson’s written statement, she noted that GAO’s most recent 
report did not include specific instances of management abuse. In 
conducting this review, did yon find continuing instances of management 
abuse? Do you continue to receive hot-line complaints firom DCAA 
employees regarding abuse? If so, please explain in general terms the nature 
of the abuse. 
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We did not encounter specific instances of management abuse during our brojid 
audit, and identifying management abuse was not part of our audit objectives. 
However, during our audit we continued to receive numerous hotline complaints 
about DCAA audit quality and management abuse. For example as discussed in our 
report, of the 34 hotline complaints we received since our investigation, 21 related to 
abusive management actions, such as auditors being penalized for attempting to 
perform what they believed was sufficient testing to support audit opinions and 
auditors failing to complete work within established time frames. Further, DCAA has 
received over 200 internal hotline complaints, many of which relate to abusive 
management actions. 

We have continued to receive hotline complaints from DCAA auditors regarding 
management abuse since the September 23, 2009, hearing. One-third of the 34 
complaints that we received relate to Western Region management Several of these 
complaints relate to management retaliation after auditors objected to their audit 
findings being dropped. In many of these cases, the auditors had their performance 
appraisals lowered ft'om their previous year appraisals. 

4. In Mr. Hale’s testimony, he stated that DCAA, with the assistance of DOD, 
needs to focus on three major issues: (1) improving the quality of audits, (2) 
assessing the number and types of audits performed by DCAA, and (3) 
assessing improvements to the process for resolving DCAA audit results to 
ensure the audit findings are fiilly considered during contracting officer 
deliberations. What are some specific steps that you believe the Comptroller 
could take to help DCAA address these and other issues? 

Developing a risk-based audit approach will help to Improve audit quality as well as 
facilitate an identification and assessment of the number and types of audits that 
would provide the greatest assurance of protecting taxpayer interest within available 
resources. DOD has established an appeals process that permits DCAA to seek 
resolution when there are differences of opinion with regard to the resolution of audit 
findings. Unresolved appeals would be elevated to the Under Secretary of Defense 
for Acquisition, Technology, and Logistics and the Under Secretary of Defense 
(Comptroller), acting as a team. As a matter of transparency, it is important for the 
Under Secretaries to develop written protocols for resolving such appeals and 
documenting the results of fteir decisions. In addition, the Comptroller could help 
ensure that DCAA obtains outside technical expertise in auditing standards to advise 
DCAA on needed revisions to audit policies and procedures and development of 
training courses on auditing standards. As noted in our report, we found an insular 
environment at DCAA Hiring some outside expertise at the executive level, 
especially in areas such as auditing standards, could help DCAA take a fresh look at 
its audit methodologies and training and focus on specific problems, such as 
insufficient audit testing. Further, the Comptroller could facilitate contacts with 
professional enterprise risk management groups and ensure that funding is available 
for DCAA to consult with outside experts in addition to DOD stakeholders to 
facilitate the development of a risk-based audit approach. Clearly, strong leadership 
and oversight from the DOD Comptroller in implementing our recommendations is 
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critical. Moreover, the DOD Comptroller should ensure that DCAA has the necessary 
support from the DOD contracting and finance commuruties in accomplishing 
cultural change. 

5. Mr. Heddell has disagreed with GAO’s recommendation that the DOD 
Inspector G«neral rescind its 2007 peer review of DCAA, although Mr. 
Heddell has characterized it as “expired.” What is the difference and in 
practical terms what does this mean for DCAA? What does it mean for DOD 
and other agencies that rely on DCAA audits? 

Auditors who assert that they follow GAGAS must have an external peer review every 
3 years.'^ DCAA’s 3-year period has passed without obtaining another peer review. 
However, DCAA’s last peer review opinion has not “expired." There is no such thing 
as an “expired" opinion. A peer review opinion covers a specific period of time and 
remains in effect, unless specifically rescinded, as an independent opinion about the 
quality of audit work performed during that period. By falling to rescind the 2007 peer 
review, the DOD Inspector General (IG) is effectively continuing to assert that during 
the period from fiscal year 2004 through 2006, there is reasonable assurance that 
DCAA audits were performed in accordance with professional standards. DOD IG is 
making this assertion in the face of overwhelming evidence to the contrary, as 
evidenced by 81 rescinded reports^ from this period and the DOD IG’s own findings of 
quality control problems during the peer review. In practical terms, given the findings 
from our two reports,* DOD and other agencies that rely on DCAA audits in at least 
some cases, would have inappropriately relied on flawed audit work. For example, in 
the case related to the EELV Delta IV Buy HI program, despite evidence to the 
contrary, DCAA gave an “inadequate-in-part” opinion in its May 8, 2006, proposal 
audit report, which allowed the contractor to recover $271 million of unallowable 
costs for commercial satellite launch losses under this proposal and another $114 
million related to the subsequent the Joint Venture contract. Had the audit been 
performed properly, and the original findings by the DCAA auditors reported, the 
contractor would not have been allowed to bill these millions of dollars of questioned 
costs (i.e., losses) to the government, and the subsequent investigations and recovery 
efforts for the improper payments would not have been necessary. 

Another important implication for DCAA relates to audits it is currently conducting, 
which must now be qualified. Because DCAA is no longer in compliance with the 
external peer review requirement, its audit report opinion language must contain a 
modified GAGAS statement to note that it has not met this requirement. 


^GAO-07-731G1,§3.55. 

^ In addition to the 80 rescinded reports noted in our September 23, 2009, testimony (GAO-09- I009T) DCAA has 
rescinded the May 8. 2006. Evolved Expendable Launch Vehicle (EELV) Delta IV Buy HI Audit report. 

* GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet Professional Standards 
Were Substantiated, GAO-08-857 (Washington, D.C.; July 22, 2008) and DCAA Audits: Widespread Problems with 
Audit Quality Require Significant Reform, GAO-09-468 (Washington, D.C.: Sept. 23, 2009). 
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6. You and the DOD IG have explored the issue of management abuses in 
DCAA’s Western Region, yet have come to somewhat different conclusions. 
How do you account for that difference? 

We believe the differences between the DOD IG findings and the findings in our 
investigation relate to differences in documentation reviewed, the timing of the IG 
investigation, and differences in the individuals interviewed. For example, the IG’s 
finding that only one individual received instruction from management to withhold 
information from investigators appears to be referring to the “gag order memo” 
received by one employee — the GS-12 auditor who testified before the Committee 
last year. Our report summarized a number of communications to auditors through 
staff meetings, discussions, and e-mails. For example, an e-mail message sent to field 
office auditors by the Western Region provided instructions about handling their 
meetings with our investigators. This e-mail states, “You are not authorized to take 
any audits or audit working papers with you to the interview imless they are cleared 
through the Branch Manager first." Several auditors told us that they feared reprisal if 
their management knew what documents they had planned to give us. This also 
posed a conflict of interest because the Branch Manager who was a subject of our 
investigation was in a position to filter information before it was provided to us and 
could also intimidate or discourage auditors firom providing us information. 

We also obtained written notes on a staff meeting that show auditors were concerned 
about being fired if they spoke ill of the agency to outside parties or provided 
information to parties outside the agency. Tire e-mail response from the supervisor 
stated, “I don’t think “fired” was one of the items discussed - we only covered 
reprimands^suspensions.” The auditors viewed this as a serious threat since 
reprimands and suspensions are official disciplinary actions and are documented in 
employee personnel files. 

Further, the DOD IG issued the follow-up review 2 years after we interviewed 
employees at the two DCAA locations. TTiere was significant staff turnover and hiring 
during this period. Consequently, IG auditors would not have interviewed all of the 
same individuals that we met with during our investigation. 

7. Both GAO and the IG found that supervisory auditors in DCAA’s Western 
Region changed audit findings without support documenting a basis for those 
changes. Ms. Stephenson has stated that she is legally unable to take action 
against the supervisors identified in the GAO reports. Do you agree with Ms. 
Stephenson’s view? 

To determine what disciplinary action DCAA could take with regard to the 
supervisory auditors and managers who did not follow professional standards, DCAA 
and its legal advisors need to assess the facts of each case and the law applicable to 
the type of adverse action that DOD could propose to take against those individuals. 
Depending on the employment status of each supervisor and manager and the facts of 
each case, the taw may or may not preclude DCAA from taking certain adverse 
actions against its employees. 
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In general, adverse actions against employees fall into two categories: performance- 
based (chapter 43 of title 5, U.S. Code) and disciplinary (chapter 75 of title 5, U.S. 
Code). For unacceptable performance, agencies generally have 1 year from the time 
of the performeince in question to give notice to an employee of the agency's proposal 
to reduce the employee's grade or remove the employee.' However, for disciplinary 
actions, there is no fixed, statutory time limit on when action may be token. Under 5 
U.S.C. §7513, disciplinary actions can be taken pursuant to agency regulations for 
such causes as will promote the efficiency of the service. Instead, appellate 
authorities, in cases interpreting this authority, have drawn inferences that an agency 
is acting in bad faith or that there is insufficient cause for action when there were 
lengthy delays in initiating the disciplinary action. Agencies may be able to overcome 
such inferences by producing sufficient evidence to establish cause and good faith 
action. These are also factual matters for the agency to assess when deciding whether 
to initiate action. For members of the Senior Executive Service, performance-based 
action generally may be token for less than fuUy successfiil performance,' and 
disciplinary action may be token only for misconduct, neglect of duty, malfeasance, 
or failure to accept a directed reassignment or to accompany a position in a transfer 
of function.' We have not conducted a legal analysis of each DCAA case to assess the 
merits of DCAA’s decisions to take or not to take any adverse action because any 
analysis will involve cost-benefit factors, including litigation costs and risks, that 
DOD should assess for itself. 

8. Some critics of GAO’s report on DCAA state that because the audits 
reviewed were from 2004-2006, GAO did not acknowledge the impact of 
changes made by DCAA. How would yon respond to those critics? 

Although the audits we reviewed related to prior years, DCAA has acknowledged that 
many of the same issues continued into fiscal year 2009. For example, as discussed in 
our report, DCAA’s quality assurance reviews for fiscal years 2007 and 2008 found the 
same audit quality issues as our review of earlier audits. Further, the DCAA Director 
has acknowledged that it will take several years for reforms undertaken in response 
to oxir work to have a pronounced effect On September 1, 2009, the DCAA Director 
wrote to GAO stating that DCAA would not be ready to undergo a peer review by the 
DOD IG until 2011. The Director stated that this would give DCAA time to develop 
and implement policies during fiscal year 2010. Thus, it will be several yesus before 
DCAA audit work is improved to the extent that an independent, external oversight 
organization would be able to draw a conclusion about the overall impact of the 
improvements. 

In addition, we reported that DCAA has taken some steps that are intended to 
improve the quality of DCAA audits. However, most of these changes related to 
processes eind have not addressed fundamental weaknesses in audit quality or 


" 5 U.S.C. § 4303(c). 
^ 5 U.S.C. § 3592. 

’ 5 U.S.C. § 7543. 
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approach. While the audits of contractor business system internal controls that we 
reviewed covered fiscal years 2004 through 2006, these audits were still being relied 
on for meiking decisions on contract pricing, award, and payment Further, because 
the opinions on these audits provide the basis for planning the nature, extent, and 
timing of test work on other audits, such as contractors’ annual incurred cost audits, 
they impacted billions of dollars in contract decisions. For this reason, DCAA has 
rescinded 81 audit reports, stating that the support for the audit opinions was 
insufficient and that the reports could not be relied on for making contract decisions. 
We also found that DCAA had not sufficiently revised its most recent audit policies 
and procedures issued during fiscal years 2008 and 2009, and its most recent audit 
quality assurance reviews continued to find the same types of problems we reported. 
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Gregory D. Kutz, Managing Director, 

Forensic Audits and Special Investigations 

Responses to Questions 
from Senator Tom Coburn 

Committee on Homeland Security and Governmental Affairs Hearing 
on Defense Contract Audit Agency: Who Is Responsible for Reform? 

September 23, 2009 

1. What would be the practical effect of ending or phasing out the direct bill 
program utilized by the Department of Defense? 

DCAA approval of contractor participation in the direct-bill program allows 
contractors to submit invoices directly to a government disbursing office without 
prior review. Ending this program would mean that all contractor invoices would 
require some level of scrutiny by management prior to payment Under DOD's 
existing policy,® phasing out the direct-biU program would mean that DCAA would 
perform limited reviews of contractor interim cost-reimbursement vouchers for 
certain information on the voucher itself, such as computation of amounts and 
consistency with contract payment terms. However, this policy calls for less stringent 
review than for other contract payments, such as vendor payments, for which 
contracting officers, certifying officers, or possibly program managers need to review 
contractor invoices prior to payment to assure that contractor billings represent 
goods and services provided to the government and that amounts billed comply with 
law, federal acquisition regulations, cost accounting standards, and contract terms. 

As we noted in our audit report, 31 U.S.C. § 3621(b) authorizes agency heads to cany 
out a statistical sampling procedure, within certain parameters, to audit vouchers 
when the head of the agency determines that economies will result. Further, as the 
Defense Finance and Accounting Service (DFAS) expands the implementation of 
forensic software used for accounting and payment reconciliations, which has 
identified hundreds of millions of dollars in duplicate invoices and other billing 
errors, it may be more effective to rely on DFAS to perform reviews of contractor 
invoices. 

The direct-bill program is one of the areas that DOD should consider in developing a 
risk-based contract audit approach. For example, DCAA voucher reviews are 
nonaudit services that DCAA performs to support contracting officers and certifying 
officers. As discussed in our report, in developing a risk-based approach, it will be 
important for DCAA to work with key stakeholders in the DOD contracting and 
finance communities to re-evaulate whether DCAA, as an independent audit 
organization, should perform any nonaudit services, such as reviewing contractor 
invoices prior to payment by the government and performing financial liaison 
advisory services for contracting officers. 


® Department of Defense, Financial Management Regulation (HMR), vol. 10, ch. 10, § 100202. 
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2. At what point is an aggressive change in leadership at DCAA warranted? In 
your opinion, are large government organizations attempting comprehensive 
change able to achieve this change with the same personnel? 

On October 26, 2009, the DOD Under Secretary of Defense (Comptroller) announced 
that effective November 9, 2009, Mr. Patrick Fitzgerald, the current Auditor General 
of the Army, will be taking over as the new DCAA Director. Mr. Fitzgerald is a CPA 
and has almost 30 years of audit experience. He currently heads up the DCAA 
Oversight Committee, which the DOD Comptroller set up in March 2009 to help 
provide increased DCAA oversight 

While the role of the DCAA Director is crucial to effective organizational reform, it is 
also important to acknowledge the leadership role that the DOD Comptroller and 
Secretary of Defense must play in addressing DCAA’s fundamental weaknesses. For 
example, in July 2008, we reported* that DCAA viewed its customer as the contracting 
officer, not the taxpayer. In response to our investigation, the Defense Business 
Board recommended that the Secretary of Defense revise DCAA’s mission statement 
to identify the taxpayer as the primary customer and focus on core audit services that 
ensure taxpayer dollars are spent on fair and reasonable contract prices. In 
September 2009,'° we reported that DOD had not yet acted on this recommendation. 
The success of the change depends on the tone set by agency leadership and the 
abilities of the personnel and the types of changes that are necessary, among other 
factors. 

Our work" to identify useful practices and lessons learned from mergers, 
acquisitions, and cultural transformation of large public and private sector 
organizations and our work to assess federal agency management reform related to 
implementation of the Government Performance and Results Act" found a number of 
key practices that aie at the center of management success as federal agencies seek 
to transform their orgemizations and cidtures in response to governance challenge. 
These practices include the following: 

• Ensuring that top leadership drives the transformation. Leadership must 
set the direction, pace, and tone for the transformation and is essential to provide 
a clear, consistent ration 2 de that unites employees behind a single mission to 
guide the transformation. While the indispensable role of top leadership was cited 
(in the federal context, the agency Secretary, Deputy Secretary, and other high- 
level political appointees), it was also noted that it is important to have a cadre of 
champions (such as political and career executives) from within the organization 


* GAO-08-857. 

GAO-09-468. 

" GAO, Highlights of a C AO Fonim: Mergers and Transformation: Lessons Learned for a Department of 
Homeland Security and Other Federal Agencies, GAO-03-293SP (Washington, D.C.: Nov. 14, 2002). 

GAO, Fjiecu/ive Guide- Effectively Implementing the Government Performance and Results Act, GAO/GGD-96- 
118 (Washington, D.C.: June 1996). 
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to work with top leadership to ensure changes are thoroughly implemented and 
sustained over time. 

• Establish a coherent mission and integrated strategic goals to guide the 
transformation. Mission clarity is especially essential to define the purpose of 
the transformation to employees, customers, and stakeholders. In addition, the 
strategic goals must align with and support the mission and serve as the 
continuing, visible guideposts for decision making. The mission and strategic 
goals must he clear to employees, customers, and stakeholders and be seen as the 
driving force of the changes that are being made. A well-defined mission and 
strategic goals also are essential to helping the new organization and its 
customers and stakeholders make intelligent trade-offs among short- and long- 
term wants, needs, and affordability and to ensuring that program and resource 
commitments made early in the transformation process are sustainable over the 
long run. 

• Focus on a key set of principles and priorities at the outset of the 
transformation. In bringing together the originating components, the new 
organization must have a clear set of principles and priorities that serve as a 
framework to help the organization create a new culture and drive employee 
behaviors. Leadership identifies these principles and priorities at the outset of the 
transformation. These principles and priorities include emphasizing and enforcing 
the core values that are fundamental to the organization. 

Given the problems with DCAA’s management environment, which included a focus 
on producing audit reports over assuring quality audits that protect taxpayer interest 
and employee fear of reprisal if they disagreed with management decisions, it will be 
important for the new DCAA Director to reinforce core values and hold managers 
accountable for their actions. As a positive set of core values becomes embedded in 
the organization along with the new mission statement and strategic goals, these core 
values can serve as an anchor that remains valid and enduring as DCAA undergoes its 
cultural transformation. 

3. Should GAO begin another report next year on DCAA to monitor changes 
and compliance with recommendations? 

We would be pleased to meet with Committee leadership to discuss follow-up work 
on DCAA. As part of its audit ciose-out process, GAO follows up on all 
recommendations to determine whether, and to what extent, they have been 
implemented. Upon request, we will provide this information to the Committee as it 
becomes available, regardless of whether we conduct further audit work. 

4. What impact will GAO’s report have on the ability of other auditors and 
Defense Department management to rely on DCAA’s work? 

The substantial evidence of widespread audit quality problems that we found at 
DCAA significantly impact the ability of other auditors and DOD management to rely 
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on DCAA’s work for decision making on contract pricing, contract awards, and 
payment. As of mid-October 2009, DCAA had rescinded 81 audit reports in response 
to our work and the DOD Inspector General’s (IG) follow-up audit because the audit 
evidence was outdated, insufficient, or inconsistent with reported conclusions and 
opinions and reliance on these reports for contracting decisions could pose a 
problem. About one-third of the rescinded reports relate to unsupported opinions on 
contractor internal controls and were used as the basis for risk assessments and 
planning on subsequent internal control and cost-related audits. Other rescinded 
reports relate to cost accounting standards compliance and contract pricing audits. 
Because the conclusions and opinions in the rescinded reports were used to assess 
risk in planning subsequent audits, they impacted the reliability of hundreds of other 
audits and contracting decisions covering billions of dollars in DOD expenditures. 

The impact of DCAA’s work goes beyond DOD to the National Aeronautics and Space 
Administration and the Departments of Homeland Security, Energy, Health and 
Humsin Services, £ind others. 

5. What impact do the DCAA audit deficiencies identified in your report have 
on Congress’ ability to rely on DCAA to identify and report questionable 
contractor costs? 

Based on substantial evidence of widespread audit quality problems at DCAA, 
Congress, DOD, and taxpayers lack reasonable assurance that DCAA is able to 
effectively identify and report questionable contractor costs, as well as determine the 
adequacy of contractor systems and proposals. DCAA’s failure to perform sufficient 
testing to support audit conclusions and opinions, as required by generally accepted 
auditing standards (GAGAS), “ leave the government and taxpayers vulnerable to 
fraud, waste, abuse, and mismanagement For example, DCAA has used poor-quality 
audit work as the basis to admit contractors into DOD’s direct-billing program, which 
subsequently allowed contractors to bill the government with very limited review of a 
few selected invoices prior to their submission for payment In response to our 
findings, DCAA has rescinded 81 audit reports and removed over 200 contractors 
from the direct-billing program. 

6. According to DCAA’s website it claims that it “audited $130 billion in costs 
incurred on contracts... Approximately $3.3 billion in net savings were 
reported as a result of audit findings.” Is this statement reliable in light of 
your recent report? Does this imply that DCAA could find even more savings 
if it fiinctioned properly? 

We did not independently validate DCAA reported questioned costs or net savings. As 
discussed in our report, for fiscal year 2008, DCAA reported $6.7 billion in questioned 
costs of which $4.2 billion was sustained by contracting officers. DOD contracting 
officers are responsible for using DCAA recommendations to disallow questioned 
costs. 


GAO-03-673G, § 6.04b. 
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The $3.3 billion in net savings is the amount the government reportedly saved. For 
example, for incurred cost audits, DCAA guidance” for calculating net savings is as 
follows; 

(1) Under cost-type contracts, the questioned costs sustained to be reported is the 
same as the net savings amount. 

(2) Under incentive-type contracts, the net savings amount to be reported is the 
government’s share of any questioned costs sustained. 

(3) For overhead, general and administrative expense, and home office allocations, 
net savings will be calculated using the mix of contracts in (1) and (2) above 
applied to the questioned cost sustained. 

For pricing proposal audits, DCAA guidance'* states that net savings is the amount of 
cost, profiUfee, or both that the government saves through sustaining the auditor’s 
findings (e.g., questioned cost). The amount of savings depends on the type of 
contract negotiated. 

DCAA internal audit quality reviews continue to identify significant recurring audit 
deficiencies in pricing and incurred cost audits. DCAA audits of contractor pricing 
proposals and incurred costs are the source of most DCAA questioned costs and 
dollar recoveries. Accordingly, we expect that improvements in DCAA’s risk-based 
audit approach, sufficiency of testing, and independence have the potential to result 
in increased questioned costs and savings to taxpayers. 


Defense Contract Audit Agency, DCAA Guidance for Calcidating and Reporting Audit Results in the 
DCAA Management Inf ormation System (DMIS), Revision 1, (January 2008), app. A, § 11. C. 6. 

DMIS. app. A, I V.C. 3. and § VI, C. 2. 
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Post-Hearing Questions for the Records 
Submitted to the Honorable Gordon S. Heddell 
From Senator Joseph I. Lieberman 

Subject; Defense Contract Audit Agency: Who is Responsible for Reform? 
September 23, 2009 


1. Based on the testimonies of yourself and the other witnesses about the problems at 
the Defense Contract Audit Agency (DCAA) and the steps Ms. Stephenson has 
taken to address those problems, what are the most pressing reforms that you think 
are still needed at DCAA? 

Answer. One of the more important areas that DCAA needs to address is the reform of a 
long-standing culture of focusing on quantity over quality. Emphasis from strong leadership at 
the top and down through all levels of supervision with follow-up can change this environment, 
especially when coupled with careful attention to DCAA staff concerns. Not only will less 
emphasis on time-based metrics improve the quality of DCAA audits by allowing a more - 
deliberative process, but it will also improve morale by providing DCAA employees’ a greater 
sense of the value of their contribution to the procurement proeess. It will encourage a more 
rigorous review of contract actions to ensure proper proeurement practices. The Office of 
Personnel Management administered an organizational assessment survey of DCAA in October 
2008,before s everal of DCAA’s corrective actions took effect. Therefore, I would recommend 
that 0PM conduct a resurvey in the near future to gauge the effectiveness of DCAA corrective 
actions and to set another benchmark for future evaluations. 

2. One concern our staff has heard from DCAA employees is that they do not trust 
either DCAA headquarters or the IG's office to adequately follow up on their 
concerns. Are you aware of this distrust, and if so, what are yon doing to restore the 
trust that employees have in your offices? 

Answer. I am not aware of such distrust of the DoD IG nor have evidence to that effect. 
Nonetheless, we are constantly assessing our Hotline to ensure it has the resources needed to 
promptly and accurately evaluate complaints and to ensure that investigations of those 
complaints are thorough and complete. Whistleblowers are a vital source of information for 
Inspectors General in performing their mission to detect and prevent fraud, waste, abuse and 
mismanagement. Promoting trust among individuals, within and outside government, to come 
forward with information is always a priority for my office. I believe that the Defense Hotline 
Program continues to be viewed by DoD civilian and contractor employees, military service 
members and the public as a trusted, viable means of reporting improprieties affecting the 
Department. We continue to receive close to 14,000 contacts annually and have not seen a 
decline in the number of allegations submitted pertaining to DCAA. To maintain that trust we 
must eontinually strive to do a better job in being responsive to whistleblowers by ensuring 
complaints are handled promptly and appropriately. Whistleblower proteetion is critical to the 
success of the DoD Hotline Program. Consequently, in carrying out our primary mission of 
providing a confidential and reliable vehicle for reporting fraud, waste, abuse, and 
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mismanagement, we make every possible effort to protect the identities of all IG sources of 
information. 

3. As you know, in some small DCAA oiTices, it wonld be pretty easy to fignre ont who 
complained, even if the name is not revealed. I am sure you recall that last year the 
Committee was extremely concerned that the IG had not protected the identity of 
one anditor who had contacted yonr hot-line. What are you doing to ensure that 
those who lodge complaints are protected from retaliation? 

Answer. As a result of concerns raised at the hearing before this Committee last year, we 
have implemented new procedures for handling Hotline complaints pertaining to DCAA. 

Hotline allegations regarding auditors, audit organizations, deficient audits, and abusive work 
environment issues are referred internally to our Audit Policy and Oversight Directorate. We 
have also continued our standard practice of removing complainant’s personal identifying data 
from Hotline referrals unless we have the complainant’s consent for release. 

In order to strengthen our policies and procedures to protect our Hotline sources, we have 
also redesigned our case processing forms and added clear instructions as to their proper, official 
use. In addition, we have also revised the warning statement affixed to all Hotline complaints: 

This is a Department of Defense Inspector General (DoD IG) document and may 
contain information that could identify an IG source. The identity of an IG source must 
be protected. Access to this document is limited to persons with the need-to-know for the 
purpose of providing a response to the DoD IG. Do not release, reproduce, or 
disseminate this document (in whole or in part) outside DoD without the prior written 
approval of the DoD IG or designee. Do not permit subjects, witnesses, or others to 
receive, review, or make copies of this document. 

In October 2008 we completed a revision of our Hotline operating instruction. The 
revised instruction provides detailed guidance for our staff with regard to the proper evaluation 
and handling of Hotline allegations. 

4. In Mr. Hale's testimony, he stated that DCAA, with the assistance of DOD, needs to 
focus on three major issues: (1) improving the quality of audits, (2) assessing the 
number and types of audits performed by DCAA, and (3) assessing improvements to 
the process for resolving DCAA audit results to ensure the audit findings are fully 
considered during contracting officer deliberations. What are some specific steps 
that you believe the Comptroller could take to help DCAA address these and other 
issnes? 

Answer. The Comptroller in performing his management function over DCAA needs to 
determine the specific steps he should take to help DCAA address these and other issues. 

Timely implementation of the Defense Business Board recommendations will address some 
issues. For instance, the Comptroller now has a DCAA audit advisory committee to provide him 
and his staff advice on what potential actions can be taken to improve DCAA audit quality and 
effectiveness. He and his staff are responsible for managing DCAA’s implementation of 
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solutions and taking appropriate actions if improvements do not materialize in a reasonable time 
period. My office looks forward to working with the Comptroller, when appropriate in an 
advisory capacity, to effect the much needed improvements to not only DoD contract audits but 
the overall DoD acquisition environment, 

5. In your response to GAO's draft report, you disagreed with GAO’s 

recommendation that the DOD Inspector General rescind its 2007 peer review of 
DCAA, although you have characterized it as "expired." What is the difference 
between the two actions and in practical terms what does this mean for DCAA? 
What does it mean for DOD and other agencies that rely on DCAA audits? 

Answer. If the opinion report was rescinded, any reported deficiencies would be 
removed from the official record. By expiring the opinion, the report is allowed to remain part 
of the record and continues to document repeat deficiencies and the potential failure of DCAA to 
adequately correct them. GAO identified other deficiencies and problems as a result of its audit 
and hotline investigation. Given the recent GAO report findings, the IG decided to place an 
expiration date on DCAA’s clean opinion so that DoD and other agencies do not continue to rely 
on the May 1, 2007, peer review opinion in relation to current Defense Contract Audit Agency 
work. 


After August 26, 2009, DCAA had to qualify all its audit reports with a modified 
generally accepted govenunent auditing standard (GAGAS) statement noting an exception to 
compliance with the Quality Control and Assurance standard, DCAA was also to publicly 
disclose on its website the GAO concerns regarding the reliability of DCAA audit reports issued 
during the period covered by IG DoD May 2007 opinion which covered the year ending 
September 30, 2006. DCAA has published its memorandum explaining the expiration of the 
peer review opinion, but has not yet published the GAO concerns. 

Users of DCAA reports including non-DoD organizations should assess for themselves 
what additional oversight or monitoring steps they need to conduct to rely on DCAA work. To 
date, two Offices of Inspectors General have contacted us to discuss additional monitoring 
activities until DCAA receives its next peer review opinion. 

6. Given the DOD IG's audit policy and oversight role, and the need to help DCAA 
assure effective corrective actions, do you agree that DCAA should seek another 
peer reviewer when it is ready for the next peer review in order to avoid a conflict? 

Answer. The Inspector General Act requires that DoDIG provide policy direction, 
monitor and evaluate contract audits within the Department. Peer review is one way in which we 
have chosen to fulfill our statutory responsibility. No conflict exists that would impair us from 
conducting the peer review. DCAA and my office plan to get GAO’s perspective on what 
organizations could perform the DCAA peer review. 1 am, however, concerned that if my office 
does not perform the DCAA peer review, it could be viewed as avoiding its statutory 
responsibility under Section 8(c)(6) of the Inspector General Act for performing oversight of 
DoD contract audits. My office is committed to ensuring that the peer review is conducted in 
compliance with generally accepted government auditing standards and uses appropriate best 
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practices from other peer review administering entities, no matter who performs the next DCAA 
peer review. Potential options include establishing a peer review team made up of 
representatives from other Inspectors General audit organizations with my office overseeing the 
peer review. 

7. Contractors should be treated fairly and professionally by government auditors. 
One issue of concern is DCAA's decision to eliminate the category of "inadequate in part" 
opinions, and to rely on just two categories, "inadequate" or "adequate." GAO's report 
points out that this decision could unfairly penalize contractors whose systems have less 
severe deficiencies by giving them the same opinion - "inadequate" - as contractors having 
material weaknesses or serious deficiencies. What is your view of DCAA's decision? 

Answer. It is a little early to assess the impact of this decision. DCAA revised its 
guidance in December 2008. This issue would be covered in our next peer review. However, if 
GAO agrees with DCAA’s request for a 2-year delay of the peer review, we plan to review this 
issue as one of seven identified high risk areas to determine what, if any,i mpact there is as a 
result of chtinging the policy and removing the “Inadequate in Part” opinion. 
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Post-Hearing Questions for the Records 
Submitted to the Honorable Gordon S. Heddell 
From Senator Claire McCaskill 

Subject: Defense Contract Audit Agency: Who is Responsible for Reform? 
September 23, 2009 


1. Why, if the DOD IG acknowledges that the most recent peer review of DCAA is not 
reliable, will you not re-examine the clean opinion given to DCAA in that peer 
review? Isn't it true that, despite your claim to the contrary, a peer review never 
expires? 

Answer. We have not acknowledged that the most recent peer review of DCAA is not 
reliable. We have acknowledged that the concerns raised in the GAO reports coupled with the 
significant deficiencies identified in our May 1 , 2007, peer review report warranted action on our 
part. As requested in the GAO draft report of July 2009, we reconsidered the clean opinion and 
opted not to rescind or modify the report. Many of the findings regarding DCAA deficiencies 
were the same in both the GAO report and our May 2007 peer review report. The IG DoD 
opinion was based on a wider cross-section of audits, as required by Government Auditing 
Standards. We determined that the deficiencies were not sufficiently systemic to warrant a lesser 
opinion. 

We disagree with the position that a peer review opinion neither expires nor carries forward 
beyond the period covered by the peer review. GAO identified other deficiencies and problems 
as a result of its audit and hotline investigation. Given the recent GAO report findings, I decided 
to place an expiration date on DCAA’s clean opinion. Additionally, we believe the organization 
issuing the opinion has the authority and responsibility to set the date and conditions for its 
expiration. We recognized that this was an extraordinary action. However, given the serious 
nature of the subsequent information identified in the GAO report, I maintain that this action 
ensured that users of DCAA reports would be informed of the GAO identified deficiencies and 
preclude persons from continuing to rely on the clean opinion in the May 1, 2007, peer review 
opinion in relation to current Defense Contract Audit Agency work. 

As long as a peer review opinion is available publicly, there is the potential that persons will use 
it as a basis for assuming that the work of the organization meets standards currently. In 
addition, if the opinion report was rescinded, any reported deficiencies would be removed from 
the official record. By assigning an expiration date to the opinion, the report is allowed to 
remain part of the record and continues to document repeat deficiencies and potential failure of 
DCAA to appropriately correct them. 

2. What role would the auditor in charge of the last peer review have in the upcoming 
review of DCAA by your office? Given the tacit acknowledgement that the results of 
that peer review were flawed, is it wise to have the auditor in charge of that peer 
review work on the next one? 
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Answer. The auditor in charge of the last peer review will be the Program Director on 
the upcoming review of DCAA by my office. She will be under the supervision of the Assistant 
Inspector General for Audit Policy and Oversight (AIG APO) who was selected for the AIG 
position effective September 1, 2008. The AIG APO was not involved in the last peer review, 
but became directly responsible for DCAA oversight in February 2008. The AIG APO has 
extensive OIG peer review experience. Additionally, she has worked on the working groups for 
the last three updates to the PCIE (now CIGIE) Guide for Conducting External Peer/Quality 
Control Reviews of OIG Audit Operations. 

We are considering alternatives to my office performing the peer review due to our 
interest in focusing our attention on performing more targeted reviews in high-risk areas such as 
was done for the GAO audit. 

3. I know that the DOD IG has been working with DCAA as they try to fix this mess. 
Isn't it true that current DOD OIG follow-up includes reviewing new DCAA policies and 
procedures and advising DCAA of their adequacy, as well as helping DCAA with quality 
assurance training and advising on quality assurance program improvements? If this is 
the case, isn't it possible that it will be difficult for DOD IG to maintain its independence 
and perform the next peer review? 

Answer. We consider our policy and oversight monitoring activities as routine audit 
advice and consistent with our statutory responsibilities. When requested, we provide comments 
on draft DCAA policies, emphasizing that our comments are only advisory. We point out 
obvious or potential non-compliances with standards. We give advice to other DoD audit 
organizations in similar situations. We have facilitated DCAA quality assurance staff attendance 
at the CIGIE peer review training. This training is available to all Office of the Inspectors 
General (OIG) staff who will perform peer reviews of other OIG audit organizations. We keep 
up-to-date on quality assurance program review results as part of our statutory contract audit 
monitoring function. We provide advice on quality assurance program improvements through 
recommendations in our oversight review reports and memoranda. These activities are 
consistent with our statutory responsibilities and the generally accepted government auditing 
standard on independence and do not impair our independence in performing the peer review. 
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Post-Hearing Questions for the Records 
Submitted to the Honorable Gordon S. Heddeli 
From Senator Tom Coburn 

Subject; Defense Contract Audit Agency; Who is Responsible for Reform? 
September 23, 2009 


1. All DCAA audits must note that DCAA does not have an external opinion on its 
quality control system under General Accepted Government Accounting Standards. 
Should Congress appropriate funds to contract for non-federal audit services to perform 
audits in line with GAGAS standards as a temporary measure? 

Answer. DCAA was formed to provide uniformity in DoD contract audits. Using non- 
federal audit organizations to perform DoD contract audits could result in inconsistent treatment 
of similar issues at contractor locations, inconsistencies would also negatively impact the 
acquisition community and, therefore, the overall acquisition environment. Additionally, the 
already strained DoD oversight resources would be spread between DCAA and the non-federal 
audit organizations. Available funds would be best invested in additional DoD oversight 
resources (e.g., more oversight auditors) to have the greatest chance of positively impacting the 
quality of DoD contract audits in the shortest time possible. 

2. Why has DOD IG not rescinded its clean opinion on the peer review of DCAA that 
was completed in 2007? 

Answer. We have not rescinded our opinion on the peer review of DCAA for the period 
ended September 30, 2006, for various reasons. First, many of the findings regarding DCAA 
deficiencies were the same in both the GAO report and the IG DoD’s opinion report. Secondly, 
the IG DoD opinion was based on a wider cross-section of audits as required by Government 
Auditing Standards. Thirdly, we determined that the deficiencies were not sufficiently systemic 
to warrant a lesser opinion. Finally, if the opinion report was rescinded, any reported 
deficiencies would be removed from the official record. Regardless, as a result of the additional 
questions and deficiencies identified by GAO in its July 2009 draft report, I terminated the May 
2007 opinion and announced the next peer review for the year ending September 30, 2009. 

3. Does DCAA always have to utilize the Washington Headquarters Services' office of 
Legal Counsel when needing a legal opinion on its activities? Does DCAA need its own 
legal counsel? 

Answer. The DoD IG has not examined in detail the current arrangements between 
DCAA and the Department of Defense regarding the provision of legal counsel. It is the 
understanding of this office that the DCAA is assigned attorneys from the DoD Office of 
General Counsel through the Defense Legal Services Agency (DLSA), which is a DoD agency 
under the direction, authority, and control of the General Counsel of the Department of Defense 
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(GC, DoD) that provides legal advice and services for the Defense Agencies, DoD Field 
Activities, and other assigned organizations. It is our understanding that DCAA, like many other 
DoD agencies, utilizes DLSA attorneys assigned to the Washington Headquarters Service for its 
internal personnel matters. 

4. In your opinion, does "additional training” for senior audit supervisors who fail to 
conduct audits properly send the proper message to an organization that a failure to 
adhere to standards will result in meaningful consequences? 

Answer. Additional training can be one step in sending the message that a failure to 
adhere to standards will be addressed on an individual employee basis when necessary. The rest 
of the solution needs to come from strong leadership through which DCAA managers emphasize 
the importance of conducting quality audits to the DCAA workforce. DCAA can promote a 
culture of excellence by identifying best leadership practices that enable DCAA employees to 
challenge existing processes that impede the conduct of quality audits, allow DCAA employees 
to develop competencies that would improve the quality of DCAA audit work, and encourage 
open communication between DCAA managers and employees. 
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Post-Hearing Questions for the Kecord 
Submitted to the Honorable Robert F. Hale 
From Senator Joseph I. Lieberman 

“Defense Contract Audit Agency: Who is Responsible for Reform?” 

September 23, 2009 

1. Based on the testimonies of GAO and the DOD IG about the problems at the Defense 
Contract Audit Agency (DCAA) and the steps Ms. Stephenson has taken to address those 
problems, what are the most pressing reforms that you think are still needed at DCAA? 

Answer: The most pressing reform issue at DCAA relates to assessing the number and types 
of audits performed by DCAA and as to whether all audits currently required by acquisition 
laws and regulations are appropriate. USD(C) has asked the DCAA oversight committee to 
establish this as the top priority. DCAA has already taken the first step in this process by 
instituting a revised process for determining the FY 2010 audit requirements utilizing a risk- 
based approach consistent with the GAO and Defense Business Board recommendations. 
Based on the audits required under laws and regulations and an estimate of the audits 
required to meet contracting officials’ demand requests, DCAA developed the hours 
necessary to accomplish the workload, taking into consideration the risk of the various 
contractors, the skill level of the audit staff and an estimate of the hours required to comply 
with the auditing standards. Based on this assessment, DCAA established the FY 2010 
priorities considering current staffing based on the audits of highest risk. DCAA engaged the 
Army Force Management Support Agency to evaluate DCAA’s process for planning FY 
2010 audit needs as well as our staffing requirements. My oversight committee will review 
these actions and perform an independent assessment and provide me recommendations. To 
assist in this assessment, DCAA has arranged to brief Mr. Shay Assad, Director, Defense 
Procurement and Acquisition Policy (DPAP), and a key member of my senior USD(C) staff 
on the cunent workload requirements. 

Another major reform relates to assessing improvements in the process for resolving 
DCAA audit results to ensure audit findings are fully considered during contracting officer 
deliberations. The independent DCAA voice must be heard in the contracting process to 
ensure the public interests are protected. USD(C) is working with DPAP to develop policy 
that provides for elevating major disagreements between DCAA and the acquisition officials. 
The procedures will call for bringing the issues to USD(C) and the USD (AT&L) if they 
carmot be resolved at a lower level. 

The third area of concern needs to be the continuous focus on improving the quality of 
audits, especially the approach to auditing contractor business systems. We know how 
important this is to the credibility of the DCAA audits and to the importance of protecting the 
taxpayers’ dollars. This will continue to be a top DCAA area of interest which is why they 
did a quick fix to address the issue in the training arena and issued several memos based on 
current policy. DCAA also has a project that is assessing the audit approach to each system 
that is being completed over the next few years. We know this is not a one-time fix, but it is 
a systems-by-systems revised audit approach. 
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2. In light of the high volume of audits performed by DCAA, one of the major 
recommendations of both GAO and the Defense Business Board is for DCAA to move to a 
more risk-based auditing approach. 

a. What do you see as the role of the Comptroller in deciding where DCAA’s focus 
should be? 

Answer: My main role is to support a Director who can provide focus to DCAA. 
My other role is to support the Director. See also response to QFR #1. As stated 
above, this is the most pressing reform issue also at DCAA. The DCAA oversight 
committee will provide guidance and oversee the actions that DCAA and the 
acquisition community take in this area. 

b. Do you agree with GAO that DCAA is simply doing too many audits per year - 
usually around 30,000 audits per year - with the level of auditors it has, which is now 
around 3800? 

Answer: Yes. However, a study has to be conducted to ascertain what are the right 
audits for DCAA to perform to protect the public’s interests. 


3. Both GAO and the IG found that supervisory auditors in DCAA’s Western Region changed 
audit findings without support documenting a basis for those changes. My understanding is 
that the only thing that has happened to those people is that they were sent to training and, in 
fact, some of those people had been promoted before our hearing last year. In light of Ms. 
Stephenson’s view that legally she cannot take action to demote these people or to take other 
disciplinary action, do you believe these supervisors in the Western Region should be under 
closer scrutiny to ensure that they adhere to Generally Accepted Government Auditing 
Standards and do not continue the problems cited by GAO and the IG? 

Answer: The Under Secretary of Defense (Comptroller) continues to press the lawyers to 
accomplish appropriate disciplinary actions and has assigned a member of his staff to assist 
in this process. The Director of DCAA has made several visits to the Western Region 
emphasizing audit quality and that it will not be sacrificed for any reason. In addition, 
DCAA has issued several guidance memorandums clarifying its policies for strengthening its 
compliance with GAGAS, As I believe the GAO agrees, the root causes for many of the 
GAGAS noncompliance’s related to the prior DCAA performance measures that contributed 
to a “production” approach to auditing. As the GAO acknowledges, in September 2008, 
DCAA took aggressive action by revising the performance measures to promote quality 
audits. 


4. Although you pointed out in your testimony the three main issues you think DCAA must 
address, you did not discuss the specific actions your office will take. 

a. Recognizing that your office has conducted a “tiger team” review of DCAA and has 
facilitated the movement of money from DOD’s Aequisition Workforce Development 
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Fund to help DCAA hire new auditors, what other specific steps are you taking to 
help DCAA go through the cultural transformation it needs? 

Answer: The Under Secretary of Defense (Comptroller) recently appointed a new 
DCAA Director to bring fresh eyes and aid in cultural transformation. The cultural 
transformation is an on-going process that is encouraged by the Department in several 
ways. As discussed above, we have engaged the Director (DPAP) to work with my 
staff and DCAA to work on these major reform issues facing DCAA. Additionally, 1 
will continue to ask for feedback from DCAA leadership on how their training 
programs emphasize the needed increase for audit quality, with particular focus on 
auditing contractor business systems and sampling techniques. These reforms and 
changes will be coupled with the work being done by the Center for Defense 
Management Reform at the Naval Postgraduate School. The cultural changes are 
addressed and discussed at the quarterly DCAA Executive Steering Committees 
(ESCs), and 1 send a senior staff member, who has DCAA oversight responsibilities, 
to these ESCs. Finally, the DCAA Oversight Committee (DOC) is charged with 
giving me advice on the strategic cultural changes. 

b. What role will you personally play in overseeing the transformation of DCAA? 

Answer: M y main role is to appoint a stron g Director and provide that person 
support. In addition to the daily or weekly phone/email contacts with the DCAA 
leadership I meet on a regular basis with the DCAA Director, and 1 am briefed on the 
various issues and concerns. I also meet with the DCAA Oversight Committee 
(DOC) and will take prompt actions on their recommendations. In addition, 1 will 
participate in settling significant disagreements between DCAA and the acquisition 
community to ensure the independent audit voice is heard and issues are addressed. I 
have assigned a senior member of my staff with DCAA oversight responsibility, and 
she has direct and prompt access to me on a daily basis. 

5. The Defense Business Board recommended that DCAA’s mission statement be revised to 
make clear that protecting the taxpayer’s interest is a key part of DCAA’s mission. My 
understanding is that the new mission statement is pending approval by the Office of the 
Secretary of Defense. What is the basis for the delay? When do you expect the new mission 
statement to be approved? What action can you take to expedite this process? 

Answer: The Department is currently seeking final coordination on a revised DCAA 
mission statement which is included in an updated DoD Directive 5105.36, DCAA. We are 
working with the specific offices that have not yet coordinated on the final draft. I have 
tasked my DCAA oversight staff member to give me regular updates on the status of the final 
coordination process until the directive gets a final approval signature. 

6. The Defense Business Board concluded that DCAA’s decentralized structure dilutes the 
effectiveness of managerial oversight and affects audit quality. The Board made some 
specific recommendations for DCAA to create a Chief Operating Officer and a Chief 
Planning and Quality officer, as well as a Chief of Internal Review who would serve as an 
ombudsman between DCAA staff and management. 
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a. What do you think of these recommendations? 

Answer; I believe portions of the recommendations have merit while other portions 
need further study by the new DCAA Director. In fact, DCAA has already 
established an SES-level position for the Chief of Integrity and Quality Assurance. 
On October 9, 2009, DCAA submitted a request for a new Senior Executive Service 
position for a Chief of Internal Review/Ombudman. DCAA has already assigned a 
dedicated team to the ombudsman function within the Agency. Last year, DCAA 
established an anonymous web site and ombudsman program for employees to report 
inappropriate actions by management or other employees. 

The recommendations to establish additional positions appear somewhat 
duplicative of the positions already established at DCAA. This recommendation will 
require further study considering the amount and type of audits DCAA performs. 
Once the oversight committee substantively accomplishes our primary project for 
assessing the number and types of audits DCAA performed, I will ask my oversight 
committee to look into the feasibility of creating other positions as described by the 
Defense Business Board. 

b. Do you think you have a responsibility to determine what organizational changes 
should be made within DCAA? 

Answer: Yes. USD(C) has the responsibility to make the necessary organizational 
changes at DCAA. As you know, the USD(C) recently took the major step of 
appointing a new director for DCAA. 
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Post-Hearing Questions for the Record 
Submitted to the Honorable Robert F. Hale 
From Senator Claire McCaskill 

“Defense Contract Audit Agency: Who Is Responsible for Reform?” 
September 23, 2009 


1. Can you explain why DCAA should not have access to truly independent legal advice? How 
can an attorney who is part of DOD General Counsel truly represent the interests of DCAA? 

Answer: The mission of the DCAA Office of General Counsel is to provide a full range of 
legal services to the Agency in support of the Agency’s audit mission for the Department of 
Defense. These legal services include: advice on the audit mission (contract questions that 
arise during the audit); audit policy; litigation support to DoD, the Services and the 
Department of Justice on audit issues; ethics advice; personnel and labor advice; FOIA and 
Privacy Act issues; fiscal law; security; and administrative law. The General Counsel is the 
chief legal advisor for DCAA and renders independent legal advice to the senior 
management of DCAA through the various directorates of the Agency. The DCAA General 
Counsel only coordinates with the Pentagon on those matters that are assigned by the 
Pentagon (litigation) and on matters that affect DoD as a whole. Otherwise, the DCAA 
General Counsel’s mission is to independently render legal advice that represents the 
interests of DCAA. 

2. At the hearing you mentioned that the newly formed DCAA Oversight Committee should 
pay careful attention to the Director of Defense Procurement and Acquisition Policy, D-PAP, 
as the “key customer for DCAA,” further stating that “we want to keep them in mind as we 
work to improve the agency's performance.” Who do you believe is DCAA’s primary client? 
Do you feel DCAA maintains the independence and objectivity it needs to achieve the goal 
of an audit? 

Answer: We fully understand that the public is the primary client of DCAA, and in order to 
support the public, DCAA must provide independent and objective audit assessments. 
USD(C) concurs with the Director, DPAP, in that DCAA plays a vital role in the acquisition 
process. USD(C) has identified an initiative to assist DCAA in its cultural transformation 
relating to assessing improvements in the process for resolving DCAA audit results to ensure 
audit findings are fully considered during contracting officer deliberations. The independent 
DCAA voice must be heard in the contracting process to ensure the public interests are 
protected. USD(C) is working with Shay Assad, the Director, DPAP, to develop policy that 
provides for elevating major disagreement between DCAA and the acquisition officials. The 
procedures will call for bringing the significant issues to USD(C) and the USD (AT&L) if 
they cannot be resolved at a lower level. 


3. What is the status regarding the proposed changes to the DCAA mission statement? 

Ajiswer: The Department is currently seeking final coordination on a revised DCAA 
mission statement which is included in an updated DoD Directive 5105.36, DCAA, We are 
working with the specific offices that have not yet coordinated on the final draft. I have 
tasked my DCAA oversight staff member to give me regular updates on the status of the final 
coordination process until it gets a final approval signature. 
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Post-Hearing Questions for the Record 
Submitted to the Honorable Robert F. Hale 
From Senator Tom Coburn 

“Defense Contract Audit Agency: Who is Responsible for Reform?” 
September 23, 2009 


1. Is the direct billing system, by which defense contractors submit invoices directly to the 
Department of Defense for payment without government review, used for the convenience of 
the government, the taxpayer, or the defense contractor? 

Answer: All three entities benefit from the direct billing program. The intent of the direct 
billing program is to streamline the billing process for contractors with an acceptable billing 
system. It eliminates the use of Government resources (saving the Government and 
taxpayers) to provisionally approve interim invoices that are subject to later audit when an 
acceptable contractor’s billing system reduces the risk of overpayments. It should be noted 
that whether the contractor is eligible for direct bill or not, all costs billed under cost 
reimbursement contracts are subject to a final audit. In addition, even when a contractor is 
on direct billing, DCAA performs annual testing of contractor’s billings. 

2. If there are risks from utilizing the direct billing system, are they borne by the government, 
the taxpayer, or the defense contractor? 

Answer: If there are risks with the direct billing program, the risks are borne by all three 
parties. For example, the major risk would stem from a contractor that possesses an 
inadequate system of billing internal controls. Due to the lack of controls, the risk that the 
contractor may significantly overbill or under bill increases depending on the nature of the 
control deficiency. 

3. What would be the practical effect of ending or phasing out the direct bill program utilized 
by the Department of Defense? 

Answer: The practical effect of ending the direct bill program would be a significant 
increase in Government resources required to review and process provisional payments that 
are subject to later audit. The benefit derived from these additional resources/costs is 
questionable when the risk of overpayment is reduced when a contractor system implements 
the necessary billing system controls to protect the Government. 

4. How often has your DCAA Oversight Committee met? Do they monitor progress on 
adopting recommendations by GAO and others? Do they provide specific direction to the 
DCAA director on day-to-day activities? 

Answer: The DCAA Oversight Committee (DOC) was established on March 16, 2009, and 
had its first meeting in early April 2009. Subsequently the DOC had three additional 
meetings and a field trip to a local DCAA office in northern Virginia for a total of five 
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meetings. The DOC has reviewed the recommendations by GAO and others and will be 
making recommendations to the Under Secretary of Defense (Comptroller). The DOC 
members received detailed updates at the meetings to include the status of DCAA actions 
taken. As for specific direction to the DCAA director on day-to-day activities, the DOC’s 
focus is to help the USD(C) guide DCAA on strategic remedies for overcoming the issues 
highlighted by GAO, DoD IG and others - not with a focus of how to run DCAA on a daily 
basis. 

5. Please explain the rationale by which supervisors responsible for deficient audits were 
promoted and not disciplined. Why did the Office of General Counsel recommend that no 
action be taken? 

Answer: We were informed by attorneys in the DoD General Counsel’s office and the 
Washington Headquarters Services that adjustments to prior performance ratings would not 
be appropriate and since the assignments where completed in past performance periods, the 
FY 2009 performance rating should not be adjusted. 

6. According to DCAA’s website it claims that it “audited J130 billion in costs incurred on 
contracts... Approximately $3.3 billion in net savings were reported as a result of audit 
findings.” Is this statement reliable in light of GAO’s recent report? Does this imply that 
DCAA could find even more savings if it functioned properly? 

Answer: DCAA believes this is a reliable statement. However, DCAA is performing 
several audits to follow-up on the rescinded reports and will ensure any appropriate 
overpayments are reimbursed to the Government. 

7. Who denied the request by DCAA for a Senior Executive Service (SES) level position for the 
Integrity and Quality Assurance function submitted by DCAA in September 2008? What 
was the justification behind this decision? Why did it take four months for the request to be 
denied and then six months for it to be reversed? 

Answer: On January 27, 2009, the Chairman of the Resource Allocation Committee, DoD, 
denied the SES position for Assistant Director, Integrity and Quality Assurance. No reason 
was provided for the denial. Subsequent to the denial, the DCAA Director submitted another 
request and in July 2009, the request was approved. We do not know why there was a 
significant length of time between the requests and the denial or approval 

8. Does DCAA always have to utilize the Washington Headquarters Services’ office of Legal 
Counsel when needing a legal opinion on its activities? Does DCAA need its own legal 
counsel? 

Answer: Normally, DCAA does not receive its legal advice from Washington Headquarters 
Services’ office of Legal Counsel and receives its legal advice from the DCAA Office of 
General Counsel. In unusually circumstances, where there is representational conflict, 
matters may be assigned to the Washington Headquarters Services’ office of Legal Counsel, 
in coordination with the DoD General Counsel, to safeguard the due proeess rights of the 
parties involved. Such a circumstance did occur with the Office of Special Counsel 
investigation. We believe that the Office of the General Counsel should continue to provide 
lawyers to DCAA in order to ensure training and consistent legal opinions throughout the 
Department. 
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Post-Hearing Questions for the Record 
Submitted to April G. Stephenson 
From Senator Joseph I. Lieberman 

“Defense Contract Audit Agency; Who is Responsible for Reform?” 

September 23, 2009 

1. Based on the testimonies of GAO and the DOD IG about the problems at the Defense 
Contract Audit Agency (DCAA) and the steps you have already taken to address those 
problems, what are the most pressing reforms that you think are still needed at DCAA? 

Answer: A significant reform or challenge for DCAA is balancing the contracting officer’s 
need for timely audit reports while complying with the Generally Accepted Government 
Auditing Standards (GAGAS). Contracting officers are often called upon to award contracts 
quickly in order to get needed goods and services to the war fighters. DCAA is sensitive to 
the contracting officer’s need for rapid turnaround of audits, but has little flexibility; it must 
comply with the auditing standards. Those standards require that DCAA (i) adequately plan 
the audit, (ii) gain an understanding of the system of internal controls, and (iii) obtain 
sufficient evidence as a basis for any opinion the auditors will render. 

DCAA is required by the auditing standards to perform sufficient testing. The 
need for this level of testing under the auditing standards is often at odds with the contracting 
officer need for a timely audit. We have instituted a number of processes to ensure we 
perform our audits in accordance with GAGAS. We are continuously working with 
contracting organizations to better educate them on the time necessary for adequate audits. 
Although progress has been made in FY 2009, balancing the needs for compliance with the 
auditing standards and the quick turnaround for contracting officers will continue to be a 
challenge for DCAA and the procurement community. 

Another significant reform will be to ensure DCAA has adequate staffing to perform the 
necessary audits to protect the taxpayer’s interests. Consistent with the Defense Business 
Board and GAO’s recommendations, we instituted a revised process for determining the 
audit requirements for FY 2010. Based on the audits required under laws and regulations and 
an estimate of the audits required to meet contracting officials’ demand requests, the field 
audit offices developed the hours necessary to accomplish the workload, taking into 
consideration the risk of the various contractors, the skill level of the audit staff and an 
estimate of the additional hours required to comply with the auditing standards. Based on the 
hours, we developed Agency-wide priorities. Since our funding provides for only about 65% 
of the resources required to perform all needed audits, we based the FY 2010 priorities on the 
audits of highest risk. We engaged the Army Force Management Support Agency to 
evaluate DCAA’s process for planning FY 2010 audit needs as well as our staffing 
requirements. This effort is expected to be completed by the end of October 2009. 

Changing our culture is another pressing reform that we must take to address the issues 
raised by the GAO and DOD IG. Over the course of several years, we inappropriately 
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implemented a productivity based culture driven through our metrics. Re-institutionalizing 
quality expectations over productivity will take time. To assist with this transformation, we 
have sought the assistance of the Center for Defense Management Reform at the Naval 
Postgraduate School. This is a long-term project which we anticipate to be completed over 
the next few years. 

2. In light of the high volume of audits performed by DCAA, one of the major 
recommendations of both GAO and the Defense Business Board is for DCAA to move to a 
more risk-based auditing approach, in which the selection of which contractors to audit is 
based on risk, in addition to which systems are audited. What are the challenges in the type 
of risk-based approach that the Defense Business Board and GAO recommend? 

Answer: We generally agree with the GAO recommendation and are examining whether 
DCAA can perform fewer audits while meeting public needs. DCAA already employs a 
comprehensive risk based audit requirements planning process. As stated above, we 
instituted a revised process for determining the audit requirements for FY 2010. Based on 
the audits required under laws and regulations and an estimate of the audits required to meet 
contracting officials’ demand requests, the field audit offices developed the hours necessary 
to accomplish the workload, taking into consideration the risk of the various contractors, the 
skill level of the audit staff and the hours required to comply with the auditing standards. 
The significant challenge with this approach will be to ensure DCAA has sufficient staffing 
to address the audit priorities. Since our fiinding provides for only about 65% of the 
resources required to perform all needed audits, we based the FY 2010 priorities on the audits 
of highest risk. The staffing situation will worsen before it gets better as the audits 
comprising the remaining 35% are being deferred to FY 201 1 . Without adequate funding in 
future years, the backlog of audits will continue to grow. 

This process is consistent with the GAO’s recommendation of performing a risk-based 
approach to auditing rather than “production line’’ auditing. We engaged the Army Force 
Management Support Agency to evaluate DCAA’s process for planning FY 2010 audit needs 
as well as our staffing requirements. This effort is expected to be completed by the end of 
October 2009. 

Another challenge would be the potential barriers in revising existing regulations that 
would be necessary to implement the Defense Business Board recommendation. The 
Defense Business Board recommendation was at least partially grounded on its belief that 
DCAA should be self initiating audits on competitively awarded contracts. The Defense 
Business Board believed that these awards have high rates of potential for fraud, waste and 
abuse, along with the potential for higher rates of return to the taxpayer. While we do not 
necessarily disagree with the Defense Business Board on the increased potential for fraud, 
waste, and abuse, the regulations simply do not require contractors to provide cost data in 
supptort of their estimates. Simply put, no cost data requirement means that DCAA is unable 
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to perfonn an audit. Therefore, regulations would have to be changed in order for DCAA to 
meet the expectations of the Defense Business Board in this respect. 

We are also working with Defense Procurement and Acquisition Policy, as well as the 
Comptroller’s office to assess DCAA’s current audit requirements. We expect the 
assessment will consider whether regulatory changes or congressional actions would be 
beneficial to better align contract audit oversight activities with those areas which pose the 
highest risk while eliminating and/or reducing the number of required audits. For example, 
DCAA is currently authorized to perform desk reviews at low risk contractors for the annual 
audit of cost reimbursable contracts (e.g., those contractors with less than $15 million in 
costs reimbursable work) on a cyclical basis. Desk reviews are not an audit under the 
auditing standards and are comprised of only a few procedures and are performed in the 
office and not the contractor location. We are assessing whether an increase in this particular 
threshold may reduce the number of audits required with minimal risk to the taxpayer. This 
assessment is necessary given that DCAA’s 2010 bottoms-up requirements plan revealed that 
current funding and associated staffing will permit that only 65% of the audit requirements 
will be accomplished. 

3. In your testimony you mentioned that audit priorities are established based on the audits 
required under laws and regulations. What specific laws and regulations direct the audits 
DCAA performs? 

Answer: Overall, 10 USC 2313 is the key law that authorizes DCAA to perform an audit of 
a contractor’s books and records. Contract clause FAR 52.215.2, Audit and Records - 
Negotiation, implements the statute by identifying the contracting officer or an authorized 
representative the right to examine contractor records. FAR 42.101 states that the auditor is 
responsible for “(1) submitting information and advice to the requesting activity, based on 
the auditor’s analysis of the contractor’s financial and accounting records or other related 
data as to the acceptability of the contractor’s incurred and estimated costs, (2) reviewing the 
financial and accounting aspects of the contractor’s cost control systems; and (3) performing 
other analyses and reviews that require access to the contractor’s financial and accounting 
records supporting proposed and incurred costs.” FAR 42.101(b) states, “Normally, for 
contractors other than educational institutions, the Defense Contract Audit Agency (DCAA) 
is the responsible Government audit agency. ...” 

The applicable regulatory requirements for DCAA’s major audits are discussed below. 

Before Contract Award - Audits of Pricing Proposals 

Federal Acquisition Regulation (FAR) Part 15, Contracting by Negotiation, requires the 
contracting officer to purchase supplies and services at fair and reasonable prices. FAR 
15.404-2 requires the contracting officer to request field pricing assistance (which may 
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include an audit) when the information at the buying command is inadequate to determine a 
fair and reasonable price. 

After Contract Award - Incurred Cost Audits 

The contract clause at FAR 52.216-7 Allowable Cost and Payment requires the contractor to 
submit a final indirect cost rate proposal to the contracting officer and auditor within 6 
months following the end of its fiscal year. The clause also allows the audit of the 
contractor’s invoices, vouchers, and statements of cost audited at anytime before final 
payment. 

FAR 42.7 provides policies and procedures for establishing billing rates and final indirect 
rates and FAR 42.705 establishes procedures for contracting officer determined rates and 
auditor determined rates which both require an audit of the contractor’s final indirect cost 
rate proposal. 

Requirements for Adequate Business Systems - Government Contracts 

DCAA audits contractor accounting systems before and after contract award to assess 
whether the systems are adequate for accumulating and billing costs compliant with contract 
requirements and to provide the contracting officer with information needed to meet his/her 
regulatory responsibilities under the regulations, some of which are discussed below. In 
addition, for major contractors, DCAA audits contractor internal control systems as a basis 
for relying on those systems during other DCAA audits that, as discussed above, are required 
under the FAR, e.g., audits of proposed or incurred costs. 

The overarching requirement for contractor systems for DoD contractors is Defense 
Federal Acquisition Regulation Supplement (DFARS) 242.75, Contractor Accounting 
Systems and Related Controls, which states in part: 

Contractors receiving cost-reimbursement or incentive type contracts, or contracts 
which provide for progress payments based on costs or on a percentage or stage of 
completion, shall maintain an accounting system and related internal controls 
throughout contract performance which provide reasonable assurance that — 

(a) Applicable laws and regulations are complied with; 

(b) The accounting system and cost data are reliable; 

(c) Risk of misallocations and mischarges are minimized; and 

(d) Contract allocations and charges are consistent with invoice procedures. 

FAR 16.1, Selecting Contract Types, requires contracting officers to ensure the adequacy of 
the contractor’s accounting system before agreeing on a contract type other than firm-fixed- 
price type contract. The contractor’s accounting system shall permit timely development of 
all necessary cost data in the form required by the proposed contract type. 

In addition to the overarching requirements for adequate business systems, the 
regulations specifically address certain business systems in more detail. Examples of the 
estimating system follow. 
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Cost Estimatine System 

DFARS 252.215-7002, Cost Estimating System Requirements, requires contractors to have 
an “acceptable estimating system” that: 

(1) Is maintained, reliable, and consistently applied; 

(2) Produces verifiable, supportable, and documented cost estimates that are an 
acceptable basis for negotiation of fair and reasonable prices; 

(3) Is consistent with and integrated with the Contractor’s related management systems; 
and 

(4) Is subject to applicable financial control systems. 

DFARS 215.407-5-70(c)(3) states the cognizant auditor, on behalf of the ACO, serves as the 
team leader in conducting estimating system reviews. 

Compliance with Cost Accounting Standards 

FAR 30.202-6(c) states that the cognizant auditor is responsible for conducting reviews of 
contractors’ Cost Accounting Standards Disclosure Statements for adequacy and compliance. 
FAR 30.202-7 states that the auditor shall conduct a review of the disclosure statement to 
ascertain whether it is current, accurate, and complete and conduct a review of the 
contractor’s disclosed practices to determine compliance with CAS and the Federal 
Acquisition Regulations and report the result to the contracting officer. 

4. One concern our Committee has heard is that small businesses don’t want to be left behind if 
you re-prioritize your audits. For cost-type contracts, DCAA has to audit companies before 
they can get reimbursed by the government for all costs. We are already hearing from some 
small businesses that it takes a long time for EX3AA to get around to auditing some of the 
smaller contractors, and that by the time the audits are completed, it is one or two fiscal years 
later and the agencies don’t have the money to pay up. What kind of process can you put in 
place to make sure there isn’t a backlog with small businesses? 

Answer: The regulations include procedures that allow the contractor to be reimbursed for 
all costs incurred up to the contract ceiling amount prior to a final audit and rate settlement. 
Consequently, contractors, including small businesses, are generally paid 100% for the costs 
incurred (subject to the total contract ceiling) pending completion of the audits. Until the 
audits are completed, the risk is on the Government as the audits with findings generally 
result in contractors reimbursing the Government rather than the Government reimbursing 
the contractor, FAR 42.704 provides for adjusting a contractor’s billing rates to reflect the 
unaudited actual rates once the contractor submits its certified final indirect cost rate 
proposal, until the proposal can be audited and the rates are settled. That provision states: 

When the contractor provides to the cognizant contracting officer 
the certified final indirect cost rate proposal in accordance with 
42.705- 1(b) or 42.705-2(b), the contractor and the Government 
may mutually agree to revise billing rates to reflect the proposed 
indirect cost rates, as approved by the Government to reflect 
historically disallowed amounts from prior years audits, until the 
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proposal has been audited and settled. The historical decrement 
will be determined by either the cognizant contracting officer 
(42.705-l(b)) or the cognizant auditor (42.705-2(b)). 


5. Both GAO and the IG found that supervisory auditors in DCAA’s Western Region changed 
audit findings without support documenting a basis for those changes. My understanding is 
that the only thing that has happened to those people is that they were sent to training and, in 
fact, some of those people had been promoted before our hearing last year. In light of your 
view that legally you cannot take action to demote these people or to take other disciplinary 
action, what actions are you taking to monitor these individuals and the Western Region in 
general to ensure that the problems cited by GAO and the IG do not continue? 

Answer: The Office of Special Counsel is conducting an investigation of inappropriate 
actions by some supervisors and managers in the Western Region. The investigation is still 
in process and under the Office of Special Counsel statute, we are prohibited from taking 
disciplinary action against the people named in the investigation until the investigation is 
complete and the investigation determines wrong doing. We have requested permission from 
the Office of Special Counsel to proceed with disciplinary action on the executive involved 
with the EELV issue, however, the Office of Special Counsel will not grant permission to 
proceed until they review the proposed disciplinary action. The proposed action is currently 
under review by the attorneys at Washington Headquarters Services. 

Of the 13 cases addressed by the GAO in July 2008, the manager on 11 of the cases 
retired several years ago. When the GAO issued its report in July 2008, the DCAA General 
Counsel researched and consulted with attorneys from the DoD General Counsel’s Office to 
determine whether action could be taken against a retired employee and it was determined 
that no action could be taken for the issues cited by the GAO. 

One of the 13 cases is the Boeing EELV issue in which the DoD Inspector General 
recently determined that the regional audit manager inappropriately changed the audit 
findings of the supervisor and manager, so no action against the manager or supervisor would 
be appropriate in this case. We are pursing disciplinary action against the then regional audit 
manager (now the deputy regional director as mentioned above). 

On the last case, the issue involved two supervisors who retired several years ago that 
stated that they did not have time to adequately review working papers and as a result, stated 
that they issued reports without an adequate review, although their initials on the workpapers 
indicated otherwise. This was one of the cases reviewed by the DoD IG during its follow-up 
review performed in 2009 and the IG did not conclude that actions by the manager were 
inappropriate in this case (DoD IG report issued in August 2009). 

When DCAA received the draft GAO report in early August 2009, the Director requested 
the assistance from the DoD General Counsel’s office in assessing whether the promotions 
were appropriate and if not, what actions could be taken. On August 27, 2009, the Director 
received the legal opinion from an attorney at Washington Headquarters Services. The 
opinion stated that the promotion of Angie Thomas on October 14, 2007, was appropriate 
under the circumstances (which are described in the legal response). The selection of Sharon 
Kawamoto for a manager position in July 2008 is on hold pending the results of the Office of 
Special Counsel investigation. The attorneys determined that neither the recommending nor 
selecting officials were aware of Ms. Kawamoto’s involvement in the GAO’s investigation. 
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If the Office of Special Counsel investigation concludes that Ms, Kawamoto took 
inappropriate actions, the selection will be withdrawn. 

The Washington Headquarters Services attorney’s legal opinion also concluded: 
“Promotions cannot be retroactively cancelled unless the promotion was in error or contrary 
to law or regulation. Subsequent discovery of derogatory information does not constitute a 
legal or regulatory basis to rescind a promotion.” 

Regarding “re-evaluating” the performance of the other employees, the Director, DCAA 
and the DoD Comptroller met with attorneys from the DoD General Counsel’s Office and 
Washington Headquarters Services on April 20, 2009. At that meeting, the Director 
requested an assessment on whether prior performance appraisals could be adjusted for the 
audit completed in prior years that were reported as deficient by the GAO or whether this 
prior effort could be reflected in current performance appraisals. The Director, DCAA 
received an opinion in late April 2009 from the Washington Headquarters Services attorneys 
that stated we could not adjust prior or current appraisals nor could we take any actions 
concerning prior cash awards. 

The Washington Headquarters Services attorneys reiterated their position in the August 
2009 response and stated: “The Agency is prohibited from retroactively adjusting 
performance ratings to reflect the performance criticized by the GAO and DoD/IG. 5 C.F.R. 
Section 430.208(h) requires that a performance rating shall be based on the evaluation of 
actual job performance for the designed rating period . . . .” 

The attorneys concluded: “...there is no applicable statutory or regulatory basis to 
retroactively adjust prior performance ratings or to evaluate an employee during a current 
performance rating period for unsatisfactory performance during a prior rating period.” 

Consequently, the attorneys informed the Director that it would be illegal to take any 
“performance” related action against the employees involved in the GAO report because the 
deficient audits were accomplished in prior rating periods. However, “conduct” issues may 
be taken if the Office of Special Counsel concludes that the individuals took inappropriate 
actions. 

The two supervisors mentioned in the recommendation will re-take the supervisory 
courses at our Defense Contract Audit Institute. The Regional Director, Western Region, 
will also examine external courses that may be of assistance in further developing their 
management skills. All DCAA employees should be held accountable for their 
performance. However, the first step in holding someone accountable is to ensure that they 
have an appropriate understanding of the objectives that they are expected to achieve in 
addition to ensuring that they have the proper tools to do the job right. It has become clear 
that as an Agency, DCAA drove inappropriate behavior as we unintentionally emphasized 
productivity over audit quality. While DCAA has eliminated the productivity based metrics 
and implemented quality based measures the retraining of our workforce and unlearning past 
habits that have become engrained in our culture will take time. 

By requiring at least two levels of review for all reports and careful monitoring by the 
regional audit managers of managers and supervisors in all regions, we believe we have 
improved the oversight of not only the supervisors mentioned in the GAO report, but all 
supervisors across the Agency. We have also more the doubled the number of audits 
reviewed by the Quality Assurance directorate. The increased oversight on a real-time basis 
coupled with the increase in quality assurance, reinforced by a change in expectations, should 
result in audits performed in compliance with the auditing standards. 
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In addition, in July 2008, DCAA revised its policy for resolving differences in audit 
results and opinions to elevate these differences within the management structure up to the 
Deputy Regional Director for resolution. For the oversight of Western Region, the DCAA 
Director has taken every opportunity to promote and emphasize her philosophy and 
expectation that audit quality will not be sacrificed for any reason. During FY 2009, the 
Director has made several management visits to the Western Region communicating her 
expectation on audit quality and compliance with GAGAS. 

6. One concern our staff has heard from DCAA employees is that they do not trust either 
DCAA headquarters or the IG’s office to adequately follow up on their concerns. 

a. Are you aware of this distrust, and if so, what are you doing to restore the trust that 
employees have in your offices? 

Answer: We are aware that there are some DCAA employees that do not trust DCAA 
Headquarters or the DoDIG to adequately follow up on their concerns. Prior to the 
issuance of the first GAO report, DCAA changed our practice to ensure that someone 
independent of the allegations performed the investigation. Soon after the issuance of 
the first GAO report, DCAA established a separate team, made up of GS-14 
equivalent positions and a senior Chief at the GS-15 level, to conduct the 
investigation of complaints for the Agency. This team reports directly to a senior 
executive (SES tier 2). We established a website for employees to report complaints 
in an anonymous manner, and we provided the workforce clarification in various 
memorandums on how the Agency maintains the process in an anonymous manner. 
During investigations, the Ombudsman team attempts to communicate with as many 
people as possible to try to begin trust in the team’s objectivity and independence. 
All complaints involving SES are refened to the DoDlG office for investigation to 
avoid the appearance that the senior executive in charge of the Ombudsman team 
would not be independent to other senior executives. The senior executive in charge 
of the Ombudsman team has made numerous visits throughout DCAA to explain the 
process. 

At the same time we are working hard to establish independent and objective 
policies and procedures. We believe our actions are the best method to earn trust. As 
we investigate complaints and remedies are implemented, we demonstrate by our 
actions that the Ombudsman team can be trusted to follow-up on employee concerns. 
We believe that the increase in contacts to the Ombudsman team shows that this 
method is having some success already. For example, the Ombudsman team receives 
many non-anonymous complaints from individuals already and this continues to 
grow, 

b. As you know, in some small DCAA offices, it would be pretty easy to figure out who 
complained, even if the name is not revealed. 1 am sure you recall that last year the 
Committee was extremely concerned that the IG had not protected the identity of one 
auditor who had contacted your hot-line. What are you doing to ensure that those 
who lodge complaints are protected from retaliation? 
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Answer: We agree that resolving a specific issue often reaches a point where the 
identity of the complainant can be discerned by others. The Ombudsman team takes 
great effort to protect the identity of complainants and to protect them from 
retaliation. When we begin an investigation, we often interview significantly more 
people than are involved in the complaint because even though this is more work for 
the Ombudsman team, it helps to protect the complainant from discovery. 
Throughout the process, when we reach a point where the risk of someone being able 
to discern the complainant’s identity increases we coordinate with the complainant 
again to make sure that they want to proceed. We let the complainant (if we know 
who it is) know that we will protect them from retaliation. To date, we have only had 
one specific complaint of retaliation because the employee talked to the Ombudsman 
team. In this case, the senior executive of the Ombudsman team immediately 
contacted the Regional Director and the person who is alleged to have retaliated was 
immediately transferred to a different physical office and removed from contact with 
the complainant pending the outcome of the retaliation investigation. 

7. Contractors should be treated fairly and professionally by government auditors. One issue 
that of concern is DCAA’s decision to eliminate the category of “inadequate in part” 
opinions, and to rely on just two categories, “inadequate” or “adequate.” GAO’s report 
points out that this decision could unfairly penalize contractors whose systems have less 
severe deficiencies by giving them the same opinion - “inadequate” - as contractors having 
material weaknesses or serious deficiencies. What is your view of GAO’s concern? 

Answer: We do not believe contractors are being penalized with the removal of “inadequate 
in part” opinion as auditors are only to report those deficiencies that have a potential 
significant impact on Government contracts. However, we are in the process of reassessing 
the entire approach to auditing business systems. We anticipate that our analysis will be 
completed by the end of December. This process will focus on real-time testing of 
transactions and real-time reporting of deficiencies in the contractors’ systems. It may or 
may not involve the expressing of an opinion on the adequacy of the contractor’s systems. 
Consequently, until we have completed this assessment, we will continue to issue audit 
opinions on internal controls with two opinions - adequate and inadequate. It will be 
counter-productive to revise the process for a month or two and then revise it again at the end 
of the calendar year when we complete our analysis of the new auditing process and 
procedures. 

However, if we decide to continue to issue opinions on contractor business systems, we 
believe that the two opinions are sufficient. We believe the inadequate-in-part opinion 
masked the significance of the reported deficiencies and led contracting officers to conclude 
that deficiencies reported in a report with an opinion of inadequate-in-part are not as serious 
as deficiencies contained in a report with an opinion of inadequate. Such a conclusion is not 
appropriate. 

In accordance with DCAA policy, auditors are only to report those deficiencies that have 
a potential significant impact on Government contracts. As such, all reported deficiencies 
require appropriate contracting officer attention to protect the Government’s interests while 
ensuring that contractors implement corrective actions. The regulations require the 
contracting officer to follow certain procedures whenever there is a reported significant 
deficiency, even if the deficiency affects only a portion of the contractor’s system. 
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Previously, when a deficiency impacted only a portion of a particular system, that system 
was deemed by DCAA to be inadequate-in-part. However, our experience has shown that 
the opinion of inadequate-in-part did not receive sufficient attention and corrective action 
from contractors and contracting officers even though the reported deficiencies were serious. 

The inadequate-in-part opinion caused confusion and diluted the significance of an 
internal control deficiency/material weakness in the contractor’s system. For example, past 
experience would show that withholdings against contractor billings would generally only be 
considered when the system was deemed to be inadequate rather than taking into 
consideration the seriousness of the reported deficiencies when the opinion was inadequate- 
in-part. Our review of the auditing standards indicated that there is no requirement to report 
inadequate-in-part opinions. Therefore, to ensure contractors take the appropriate corrective 
actions and contracting officers implement actions to mitigate overcharges on Government 
contracts, DCAA maintains its position to have only two opinions - adequate and 
inadequate. 

8. The Defense Business Board concluded that DCAA’s decentralized structure dilutes the 
effectiveness of managerial oversight and affects audit quality. In addition, it is our 
understanding that promotion decisions and decisions whether to rescind audit reports reside 
with the regional management. The Board made some specific recommendations for DCAA 
to create a Chief Operating Officer and a Chief Planning and Quality offieer, as well as a 
Chief of Internal Review who would serve as an ombudsman between DCAA staff and 
management. What plans do you have to act on these recommendations regarding the 
balance of power between headquarters and the regions? 

Answer: DCAA has already implemented portions of the Defense Business Board 
recommendations. Last year, DCAA established a website for complaints to be submitted in 
an anonymous manner and ombudsman program for employees to report inappropriate 
actions by management or other employees. We have assigned a dedicated team to the 
ombudsman function within the Agency. On October 9, 2009, DCAA submitted a request 
for a new Senior Executive Service position for a Chief of Internal Review/Ombudsman. 

In January 2009, the DCAA Director established a Senior Advisory Council for 
Improvement. The Council is led by the Director and comprised of Headquarters senior 
executives. The Council’s primary purpose is to establish and monitor the actions in 
response to the Defense Business Board’s report issued in January 2009 and the findings 
from the GAO and DoD IG reviews. The establishment of this Council exemplifies the 
Director’s efforts in ensuring key Agency-wide actions are managed at the Headquarters 
level versus the regional level. 

As reported previously, last year DCAA established its new Integrity and Quality 
Assuranee Directorate - essentially a new quality assurance organization that reports directly 
to the Director/Deputy Director. In addition, DCAA revised its quality assurance program 
for reporting GAGAS noncompliances which requires the regional director to provide a 
corrective action plan that address all GAGAS noncompliances reported at a particular audit 
office. In the past, corrective action plans were required only for non-compliances which 
resulted in a failing grade for the particular audit office. The Headquarters Quality 
Assurance organization will follow-up on each systemic noncompliance to ensure the field 
audit offices have eorrected their processes. In July 2009, DCAA was authorized a Senior 
Executive Service position to lead the new Integrity and Quality Assurance Directorate, 
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We believe that the establishment of the website for anonymous complaints and 
ombudsman function, the DCAA Headquarters Senior Advisory Council for Improvement, 
and the re-alignment of the Quality Assurance Program to report directly to the 
Director/Deputy Director, results in significant progress toward addressing the Defense 
Business Board and GAO’s concerns with DCAA’s “decentralized structure that has fostered 
a culture of DCAA region autonomy.” 

DCAA has over 1 00 field audit offices (FAQ) geographically dispersed all over the world 
because contractors perform on contracts and maintain their records in these various 
locations. This structure facilitates accomplishing the large numbers of audits for which 
DCAA is responsible. Each of these field audit offices is headed up by a manager (FAQ 
Manager) and each of these managers is authorized to issue audit reports and/or rescind audit 
reports. 

The five regional offices are located out amongst these various FAOs and manage about 
20 FAOs each, providing day to day technical support and oversight. Any level of 
management above the FAQ Manager up to and including DCAA Headquarters can make the 
decision to rescind a previously issued audit report, provided there is a justifiable reason. So, 
the decision to rescind audit reports does not solely rest with regional management. 

Similarly, decisions to promote employees are based on grade-level and therefore vary by 
position. For example, FAQ Managers make hiring and promotion decisions within their 
offices up to the GS- 1 2 working grade level; regions make similar decisions for the regional 
office up to the GS-13 supervisory level and they select the FAQ supervisors; and DCAA 
Headquarters makes similar decisions for Headquarters plus they select all positions above 
the GS-13 to include FAO and/or Regional Managers. Therefore, promotion decisions are 
not solely regional management decisions. 

The Defense Business Board (DBB) studied the structure of DCAA and recommended 
that DCAA establish an organizational structure designed to provide consistent governance, 
control, and quality across DCAA. The DBB gave as an example the addition of three 
positions to DCAA Headquarters (Chief Operating Officer, Chief Planning and Quality 
Officer, and Chief of Internal Review). The DBB had no specific recommendations for the 
FAO or regional structure. As stated above, the centralization of the quality assurance 
function and the establishment of a Quality Assurance Division at DCAA Headquarters has 
been accomplished. We have also established an ombudsman and internal review function at 
DCAA Headquarters. While these functions are slightly different than the DBB 
recommendations, we believe they substantially achieve the DBB desired results. 

9. During the hearing, you stated that all DCAA employees are hired at an entry level. Such a 
policy creates an insular environment that does not nurture new ideas. 

a. Do you plan to fill the new DCAA Quality Assurance SES position by selecting an 
expert from outside DCAA? If not, why not? 

Answer: The Director’s response about hiring at only the entry level was tied to her 
response regarding the funds provided in FY 2009 under the Defense Acquisition 
Workforce Development Fund. Under this fund, DCAA was authorized to only hire 
interns (auditor trainees at the entry level). When the current Director took over in 
February 2008, all senior executive positions were advertised open to all applicants 
inside and outside the Federal Government. We have received very few applicants 
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for senior executive positions. Of the applicants received from outside DCAA, nearly 
all did not meet the technical qualification as most did not have experience in 
accounting or the required accounting college credits. For the Quality Assurance 
position, we have filled it from within DCAA, For this position, three applicants 
were referred to the selecting official and the individual selected was determined to 
have the required background and experience for the position. We will continue to 
advertise positions open to all applicants. 

b. What plans, if any, do you have to integrate upper level managers from outside 
DCAA into the DCAA workforce? 

Answer: For open auditor positions, we have decided to expand our recruiting efforts 
and hire at the senior auditor level using our appropriated funds since the Defense 
Acquisition Workforce Development fund only provides funding for interns. We 
have advertised these positions open to all applicants. We have previously hired 
employees at the senior auditor level from other organizations under the priority 
placement program. 
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Post-Hearing Questions for the Record 
Submitted to April G. Stephenson 
From Senator Claire McCaskill 

“Defense Contract Audit Agency: Who Is Responsible for Reform?” 

September 23, 2009 

1, One of the areas reviewed by GAO involved cost assignments related to overpayments. In 
all ten overpayment assignments reviewed, GAO found that, despite the fact that DCAA 
guidance specifies that such assignments are supposed to comply with Generally Accepted 
Govermnent Auditing Standards (GAGAS), none of them did, or even claimed that they did. 
What steps have you taken to ensure that these types of assignments will comply with 
GAGAS in the future? What steps do you intend to take to remedy the current situation? 
Will you re-perform these assigrunents? 

Answer: DCAA has rescinded direct billing authority at the majority of the contractors 
where these overpayment assignments were performed and, in these cases, DCAA is 
performing prepayment review of contractor billings. During the GAO review, DCAA 
initiated new billing system audits at the majority of the contractor locations and these billing 
system audits incorporate the testing for overpayments. 

Agency policy does not require that these assignments to be performed' in accordance 
with GAGAS. Several of the assignments were not performed and did not report that they 
were performed in accordance with GAGAS. However, DCAA is in the process of 
reassessing the entire approach to auditing contractor business systems. We have recently 
completed our assessment of tlie process for evaluating contractor billings and we plan to 
begin field testing the revised approach this month. We have briefed the DoDlG on our 
revised approach. The overpayment effort required in these assignments is being 
incorporated into the new approach and includes focusing on performing real-time testing of 
contractor billings and key characteristics of the billing process. The new approach will 
replace current assignments related to contractor billings, including those related to 
overpayments. Therefore, DCAA will not re-perform these audits as the procedures will be 
incorporated into DCAA’s new process. 

2. While your testimony mentioned that DCAA has hired the Center for Defense Management 
Reform at the Naval Postgraduate School to assist with cultural transformation across the 
Agency and re-examine how DCAA structures its audits, the Agency is silent on the 
possibility of seeking advice and working with any entities operated outside of the 
Department of Defense. What steps have you taken to reach outside of DOD as you face the 
immense task of reforming DCAA? 

Answer: When the GAO issued the report in July 2008, we undertook an initiative to assess 
assistance from organizations external to DCAA and the Department. However, nearly all of 
the organizations including private firms, are audited by DCAA. DCAA would impair its 
independence by hiring an organizational that is audited by DCAA to assist with “cultural 
transformation.” The Naval Postgraduate School Center for Defense Management Reform 
was the only organization we discovered that specialized in reforming an organization that 
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was not audited by DCAA. Consequently, we contracted with the Center for Defense 
Management Reform to assist us with various initiatives for several years (longer if needed). 

The Defense Business Board recommended that we seek outside assistance in two areas - 
cultural transformation and an independent assessment of resources needed. As noted, we 
are using the Naval Postgraduate School to assist us in transforming the culture of DCAA, 
and they are actively supporting us today. We are also in the process of working with the 
Army Force Management Support Agency regarding the adequacy of staffing for our 
mission. 

3. For the past year this Committee has asked to be kept abreast of what actions you have taken 
related to the managers involved in the unprofessional and unacceptable conduct discovered 
by the GAO in last year’s report. We have constantly been told that “nothing can be done’ 
while investigations by the DOD IG and the Office of Special Counsel are involved. 
However, those investigations should only prevent DCAA from addressing the allegations of 
harassment. Nothing has legally prevented DCAA from taking action to remediate the 
complete failure to follow acceptable government auditing standards. In the past year, what 
specific steps have you taken in relation to the managers involved in the fourteen audits 
contained in last yeiu-’s GAO report to teach these auditors professional auditing standards 
and ensure these standards are followed? If these managers have undergone professional 
training, has any of that training been performed by persons or entities outside of DCAA or 
DOD? 

Answer: The Office of Special Counsel is conducting an investigation of inappropriate 
actions by some supervisors and managers in the Western Region. The investigation is still 
in process and under the Office of Special Counsel statute, we are prohibited from taking 
disciplinary action against the people named in the investigation until the investigation is 
complete and the investigation determines wrongdoing. We have requested permission from 
the Office of Special Counsel to proceed with disciplinary action on the executive involved 
with the EELV issue, however, the Office of Special Counsel will not grant permission to 
proceed until they review the proposed disciplinary action. The proposed action is currently 
under review by the attorneys at Washington Headquarters Services. 

Of the 1 3 cases addressed by the GAO in July 2008, the manager on 1 1 of the cases 
retired several years ago. When the GAO issued its report in July 2008, the DCAA General 
Counsel researched and consulted with attorneys from the DoD General Counsel’s Office to 
determine whether action could be taken against a retired employee and it was determined 
that no action could be taken for the issues cited by the GAO. 

One of the 13 cases is the Boeing EELV issue in which the DoD Inspector General 
recently determined that the regional audit manager inappropriately changed the audit 
findings of the supervisor and manager, so no action against the manager or supervisor would 
be appropriate in this case. We ate pursuing disciplinary action against the then regional 
audit manager (now the deputy regional director as mentioned above). 

On the last case, the issue involved two supervisors who retired several years ago that 
stated that they did not have time to adequately review working papers and as a result, stated 
that they issued reports without an adequate review, although their initials on the workpapers 
indicated otherwise. This was one of the cases reviewed by the DoD IG during its follow-up 
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review performed in 2009 and the IG did not conclude that actions by the manager were 
inappropriate in this case (DoD IG report issued in August 2009). 

When DCAA received the draft GAO report in early August 2009, the Director requested 
the assistance from the DoD General Counsel’s office in assessing whether the promotions 
were appropriate and if not, what actions could be taken. On August 27, 2009, the Director 
received the legal opinion from an attorney at Washington Headquarters Services. The 
opinion stated that the promotion of Angie Thomas on October 14, 2007, was appropriate 
under the circumstances (which are described in the legal response). The selection of Sharon 
Kawamoto for a manager position in July 2008 is on hold pending the results of the Office of 
Special Counsel investigation. The attorneys determined that neither the recommending nor 
selecting officials were aware of Ms. Kawamoto’s involvement in the GAO’s investigation. 
If the Office of Special Counsel investigation concludes that Ms. Kawamoto took 
inappropriate actions, the selection will be withdrawn. 

The Washington Headquarters Services attorney’s legal opinion also concluded: 
“Promotions cannot be retroactively cancelled unless the promotion was in error or contrary 
to law or regulation. Subsequent discovery of derogatory information does not constitute a 
legal or regulatory basis to rescind a promotion.” 

Regarding “re-evaluating” the performance of the other employees, the Director, DCAA 
and the DoD Comptroller met with attorneys from the DoD General Counsel’s Office and 
Washington Headquarters Services on April 20, 2009. At that meeting, the Director 
requested an assessment on whether prior performance appraisals could be adjusted for the 
audit completed in prior years that were reported as deficient by the GAO or whether this 
prior effort could be reflected in current performance appraisals. The Director, DCAA 
received an opinion in late April 2009 from the Washington Headquarters Services attorneys 
that stated we could not adjust prior or cunent appraisals nor could we take any actions 
concerning prior cash awards. 

The Washington Headquarters Services attorneys reiterated their position in the August 
2009 response and stated: “The Agency is prohibited from retroactively adjusting 
performance ratings to reflect the performance criticized by the GAO and DoD/IG. 5 C.F.R. 
Section 430.208(h) requires that a performance rating shall be based on the evaluation of 
actual job performance for the designed rating period. ...” 

The attorneys concluded: “...there is no applicable statutory or regulatory basis to 
retroactively adjust prior performance ratings or to evaluate an employee during a current 
performance rating period for unsatisfactory performance during a prior rating period.” 

Consequently, the attorneys informed the Director that it would be illegal to take any 
“performance” related action against the employees involved in the GAO report because the 
deficient audits were accomplished in prior rating periods. However, “conduct” issues may 
be taken if the Office of Special Counsel concludes that the individuals took inappropriate 
actions. 

The two supervisors mentioned in the recommendation will re-take the supervisory 
courses at our Defense Contract Audit Institute. The Regional Director, Western Region, 
will also examine external courses that may be of assistance in further developing their 
management skills. All DCAA employees should be held accountable for their 

performance. However, the first step in holding someone accountable is to ensure that they 
have an appropriate understanding of the objectives that they are expected to achieve in 
addition to ensuring that they have the proper tools to do the job right. It has become clear 
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that as an Agency, DCAA drove inappropriate behavior as we unintentionally emphasized 
productivity over audit quality. While DCAA has eliminated the productivity based metrics 
and implemented quality based measures the retraining of our workforce and unlearning past 
habits that have become engrained in our culture will take time. 

By requiring at least two levels of review for all reports and careful monitoring by the 
regional audit managers of managers and supervisors in all regions, we believe we have 
improved the oversight of not only the supervisors mentioned in the GAO report, but all 
supervisors across the Agency. We have also more the doubled the number of audits 
reviewed by the Quality Assurance directorate. The increased oversight on a real-time basis 
coupled with the increase in quality assurance, reinforced by a change in expectations, should 
result in audits performed in compliance with the auditing standards. 

In addition, in July 2008, DCAA revised its policy for resolving differences in audit 
results and opinions to elevate these differences within the management structure up to the 
Deputy Regional Director for resolution. For the oversight of Western Region, the DCAA 
Director has taken every opportunity to promote and emphasize her philosophy and 
expectation that audit quality will not be sacrificed for any reason. During FY 2009, the 
Director has made several management visits to the Western Region communicating her 
expectation on audit quality and compliance with GAGAS. 

4. DCAA has taken positive action by rescinding 80 audits as a result of GAO’s work. How 
much taxpayer money has been paid out in contracts where these audits were involved? 

Answer: We do not have this information as we are performing follow-up audits on the 
majority of these reports and several of these follow-up audits are in process. Some of these 
audits have disclosed internal control deficiencies and overpayments. For example, we are 
following up on the issues relating to the proposal audit for the Expanded Evolved 
Expendable Launch System. In October 2008, we requested the Air Force to suspend any 
future payments on the program until our audits are completed. DCAA is currently 
evaluating the contractor’s accounting practices to assess compliance with the Cost 
Accounting Standards for deferred program management and hardware support and 
production support costs. We expect to complete these audits by December 31, 2009. The 
final determination of CAS compliance will be made by the cognizant contracting officer. 
However, if the DCAA concludes the contractor’s practice is noncompliant with the Cost 
Accounting Standards and the cognizant contracting officer concurs with the DCAA position, 
the contractor will be required to repay any amounts relating to the deferred program 
management and hardware support costs. 

5. Much of last year’s hearing focused on a memo signed by Sharon Kawamoto, an audit 
manger, but drafted by one of the attorneys DCAA uses. Where is that attorney now? Are 
you still required to seek his legal advice on matters involving DCAA auditors? Has he been 
reprimanded in any way? 

Answer: The attorney who drafted the Memorandum is located in the Office of General 
Counsel at DCAA. The attorney was reassigned from representing Western Region and 
assigned to represent different Regions in the Agency not related to the Office of Special 
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Counsel (OSC) investigation. Disciplinary action will be considered once the OSC report is 
issued. 

6. After the hearing last year, did DCAA ever attempt to determine whether any other auditors 
had received similar memos or other messages meant to stifle their cooperation with GAO or 
Special Counsel? If not, why not? 

Answer: Two days after the September Hearing 2008, the DCAA Office of General Counsel 
drafted a rescission memorandum of the “GAG Memo” that was issued to Ms. Le. The 
rescission memorandum was given to Ms. Le by her supervisor Jan Findley. Additionally, 
the General Counsel, DCAA took immediate action and directed that all personnel actions 
Agency wide be reviewed to ensure that all the offensive language similar to that contained 
in the GAG Memorandum was removed from the personnel notification letters. This action 
was completed by the Regional HR offices, the offensive language was removed, and the 
personnel attorneys in the Office of General Counsel continue to review all pending 
personnel notification letters to ensure the offensive language was removed. 


13:37 Apr 18, 2011 Jkt 053841 


PO 00000 Frm 00134 Fmt 6601 


Sfmt 6601 


P:\DOCS\53841.TXT SAFFAIRS 


PsN: PAT 



131 


VerDate Nov 24 2008 


Post'Hearing Questions for the Record 
Submitted to April G. Stephenson 
From Senator Tom Cobum 

“Defense Contract Audit Agency; Who is Responsible for Reform?” 
September 23, 2009 


1 . What is your assessment of the performance of the Western Region office of DCAA? 

Answer: The Western Region has its challenges as it has experienced high turnover in the 
last 10 years or so. Such turnover in the auditor ranks is not unique to Western Region as 
regions that have offices in large metropolitan areas with many career opportunities generally 
experience higher auditor turnover. However, the Western Region is different in that the 
region also experienced high turnover in the management and executive ranks resulting in a 
somewhat less experienced management team than the other regions. Through careful and 
continuous oversight by the Director and Deputy Director, the region is improving. 

2. Does DCAA always have to utilize the Washington Headquarters Services’ office of Legal 
Counsel when needing a legal opinion on its activities? Does DCAA need its own legal 
counsel? 

Answer; Normally, DCAA does not receive its legal advice from Washington Headquarters 
Services’ office of Legal Counsel and receives its legal advice from the DCAA Office of 
General Counsel who is assigned to Defense Legal Services. In unusual circumstances, 
where there is representational conflict, matters may be assigned to the Washington 
Headquarters Services’ Office of Legal Counsel, in coordination with the DoD General 
Counsel, to safeguard the due process rights of the parties involved. Such a circumstance did 
occur with the Office of Special Counsel investigation. 

3. In your opinion, does “additional training” for senior audit supervisors who fail to conduct 
audits properly send the proper message to an organization that a failure to adhere to 
standards will result in meaningful consequences? 

Answer: It depends. There were two primary root causes that led to audits cited by the 
GAO that did not comply with the auditing standards. First, in the report issued in 
September 2009, many of the deficiencies related to insufficient testing and was the result of 
a shortcoming in DCAA policy, rather than a shortcoming in the auditors that followed the 
policy. The DoDIG had previously reviewed DCAA’s policy during its peer reviews and did 
not take exception to the testing policy. Consequently, development of a new policy in light 
of the GAO’s findings and training the workforce on the new policy would be appropriate. 
Second, in the report issued in July 2008, many of the deficiencies related to the staff having 
insufficient time to properly perform the audits and as a result, the staff took short-cuts when 
documenting auditing findings and working papers. In these instances providing appropriate 
staffing and budget hours to complete the audits is a must and has been done in FY 2009. 
Providing the workforce the appropriate tools, budget hours, and training is appropriate under 
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such circumstances. However, in the case cited by both the GAO and DoDIG involving 
inappropriate actions of a senior exeeutive related to the EELV issue, disciplinary action is 
appropriate and we are in the process of taking such action, 

4. Does DCAA select its leaders and supervisors (GS-14 and up) entirely from within the 
organization? Does DCAA hire senior auditors from the private sector? Should it? 

Answer: When the current Director took over in February 2008, all senior executive 
positions were advertised open to all applicants inside and outside the Federal Government. 
We have received very few applicants for senior executive positions. Of the applicants 
received from outside DCAA, nearly all did not meet the technical qualifications as most did 
not have experience in accounting or the required accounting college credits. For the Quality 
Assurance position, we have filled it from within DCAA. For this position, three applicants 
were referred to the selecting official and the individual selected was determined to have the 
required background and experience for the position. We will continue to advertise positions 
open to all applicants. 

For open auditor positions, we have decided to expand our recruiting efforts and hire at 
the senior auditor level using our appropriated funds since the Defense Acquisition 
Workforce Development fund only provides funding for interns. We have advertised these 
positions open to all applicants. We have previously hired employees at the senior auditor 
level from other organizations under the priority placement program. 

5. Given that positive performance ratings were written for supervisors who approved non- 
compliant audits, what is DCAA doing to revise its performance ratings system? 

Answer: In February 2009, we revised the job objectives/performance plans to reflect the 
DCAA’s revised performance measures focusing on performing audits in compliance with 
GAGAS and removed language that focused on the “production -oriented” concept. In 
response to the Defense Business Board recommendation, DCAA is currently performing a 
complete assessment of its performance standards and rewards program to ensure it will be 
aligned with DCAA’s new strategic plan and focuses on audit quality. 

6. The DOD IG found that the regional audit manager for DCAA’s Resident Office at Boeing, 
Huntington Beach, Califronia was not free from external impairments to independence as 
requred by General Accepted Government Auditing Standards and DCAA audit policy. Is 
this person still serving as Deputy Director of the Western Region? 

Answer: Yes. Shortly after the issuaiKe of the GAO report in July 2008, the Director 
sought legal advice from the DoD General Counsel’s office on the actions that could be taken 
against the senior executive. The Director was informed that since the GAO did not provide 
specific action items, the Director could not take action against the executive until the 
DoDIG completes an investigation of the executive. With the completion of the investigation 
by the DoD IG in September 2009, we are now in a position to take a conduct action against 
the individual. The proposed action is currently under review by the attorneys at Washington 
Headquarters Services. 
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However, approval by the Washington Headquarters Services is not enough to proceed. 
The Office of Special Counsel has requested to review the proposal before granting 
permission to provide the executive with the proposed notice. Since the executive is also part 
of the Office of Special Counsel investigation, we have been informed by the investigator 
that we must obtain their approval before proceeding with disciplinary action as premature 
discipline may compromise their investigation. In February 19, 2009, we requested 
permission from the Office of Special Counsel to proceed with disciplinary action against the 
executive based on the oral results provided by the DoD IG in late January 2009. However, 
on February 25, 2009, the Office of Special Counsel stated that we could not proceed until 
the DoD IG investigation was completed and only once the Office of Special Counsel 
investigation reviewed the proposed notice. This opinion was supported by the DoD General 
Counsel’s Office. 

Although it has been the Director’s desire to take action regarding conduct issues against 
the executive since at least January 2009 when we received confirmation from the DoD IG’s 
office that the executive compromised her independence, the input from attorneys in the DoD 
General Counsels’ office, Washington Headquarters Services and the Office of Special 
Counsel have stated that it would be a violation of the Office of Special Counsel law if we 
took disciplinary action until approved by the Office of Special Counsel. The DoD 
Comptroller agreed with the Director’s actions and agreed that she could not violate the 
Office of Special Counsel law. 
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Why GAO Did This Study 

The Defense Contract Audit 
Agency (DCAA) under the 
Department of Defense (DOD) 
Comptroller plays a critical role in 
contractor oversight by providing 
auditing, accounting, and financial 
advisoiy services in connection 
with DOD and other federal agency 
contracts and subcontracts. 

Last year, GAO found numerous 
problems with DCAA audit quality 
at three locations in California, 
including the failure to meet 
profe^onal auditing standards. 
This report addresses audit quality 
issues at DCAA offices nationwide. 
GAO was asked to (1) conduct a 
broad assessment of DCAA’s 
management environment and 
audit quality assurance structure, 
(2) evaluate DCAA actions to date 
to correct previously identified 
problems, and (3) identify potential 
legislative and offier actions for 
improving DCAA effectiveness and 
independence. To achieve these 
objectives, GAO analyzed DCAA’s 
minion, strategic plan, audit 
policies, and quality assurance 
program; con^cted interviews; 
reviewed selected audits at DCAA 
offices; and analyzed legislative 
and other actions. 


What GAO Recommends 


GAO makes 17 recommendations 
to DOD and the DOD Inspector 
General (IG) to improve DCAA's 
management environment, audit 
quality, and overeight. GAO also 
discusses matters that Congress 
should consider to enhance the 
effectiveness and independence of 
DCAA contract audits. DOD and 
DOD IG generally agreed with 
GAO’s recommendations, 
concurring with all but two. 

View GAO-09-460 or key components. 

For more information, contact Gregory Kulz at 
(202) 512-6722 or kutzg@gao. 90 v. 


What GAO Found 


GAO found audit quality problems at DCAA offices nationwide, including 
compromise of auditor independence, insufficient audit testing, and 
inadequate planning and supervision. GAO's conclusions stem from a review 
of 69 audit assignments supporting contract award and administrative 
decisions; an assessment of DCAA’s audit quality assurance structure, which 
found similar audit quality problems but gave satisfactory ratings to deficient 
audits; and DCAA’s rescission of 80 problem audit reports. The rescinded 
audits supported decisitms on pricing and contract awm'ds and impacted the 
planning and reliability of hundreds of other DCAA audits, representing 


bMon^fdoUa^i^OD^ej^^n^itures^A^finding^ncludethefollowm 

Selected of Audlte GAO Revigwad 

Contractor Audit Significant case atudy issues 

Research and BNHng • DCAA auditors spent 530 hours to suf^ort an audit of a 

developmertt system n{x>exi 3 tent billing system and reported adequate system controls, 

grantee « Instead. DCAA should have relied on the Single Audit Act report on 

the grantee’s cash management system. DCAA agrees. 

Combat Billing • This was a new system and therefore high risk, but auditors 

syste^^s system deleted key audit steps related to contractor policies arxl internal 

conbols over progress payments without explanation. 

• Orte auditor told GAO he did not perform detailed tests because 
‘the cotWacior would not appreciate it.' 

• DCAA allowed the contractor 7 months to address 6 significant 
deficiencies, dropping 2 and downgrading the other 4. 

» DC AA rescinded this audit report foHowing GAO's reviaw. 

Iraq Accounting » Contractor objected to draft report, which included 5 significant 

reconstruction system deftciencies in the accounting system. 

• Auditors dropped 5 significant deficiencies ar^d downgraded 3 
others to suggestions to improve without performirtg new work. 

» Supervisory auditors directed audit staff to delete some audit 
documents, gerterate others, and in one case, copy the signature 
of a prior supervisor onto new documents making it appear that the 
prior supervisor had approved a revised risk assessment. 

• Supervisory auditor who approved aNered documents was later 
promoted to western region quality assurance manager, where he 


Sovrcs: GAO. 


GAO found DCAA’s management environment and quality assurance structure 
were based on a production-oriented mission that put DCAA in the role of 
facilitating DOD contracting without also protecting the public interest. DCAA 
has taken several positive steps. However, DOD and DCAA have not yet 
addressed fundamental weaknesses in DCAA’s mission, strategic plan, 
metrics, audit approach, and human capital practices that had a detrimental 
effect on audit quality. 


To improve DCAA oversight, the DOD Comptroller requested Defense 
Business Board and “tiger team" reviews and established a DCAA Oversight 
Committee. In addition, in the short-term, Congress could provide DCAA with 
certain legislative protections and authorities similar to those available to IGs. 
In the longer term. Congress may wish to consider organizational changes to 
elevate DCAA to a component agency reporting to the Deputy Secretary or to 
establish an independent govemmentwide contract audit agency. 
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GAO 

AecountaMity * fc^teyHV * B«»<Mibiwv 

United States Government Accountability OfiRce 
Washington, DC 20548 


September 23, 2009 

The HonoraA)le Joseph 1, Liebennaii 
Chairman 

The Honorable Susan M. Collins 
Ranking Member 

Committee on Homeland Security and 
Governmental Affairs 
United States Senate 

The Honorable Claire C. McCaskill 
Chairman 

Subcommittee on Contracting Oversight 
Committee on Homeland Security and 
Governmental Affairs 
United States Senate 

This report addresses audit quality problems and independence issues at 
the Defense Contract Audit Agency (DCAA). In a September 2008 hearing 
before the Committee, we testified ‘ that DCAA failed to meet profession^ 
audit standards at three locations in California. Specifically, we found that 
the audit documentation for 14 selected audits at two locations did not 
support reported opinions, that DCAA supervisors dropped findings and 
changed audit C4)inions without adequate audit evidence for their changes, 
and that sufficient audit work was not performed to support audit 
opinions and conclusions. Further, we found that contractor officials and 
the Department of Defense (DOD) contracting community improperly 
influenced the audit scope, conclusions, and opinions of several audits, 
including forward pricing audits at a third location — a serious 
independence issue. During our investigation, DCAA managers took 
actions against their staff at two locations that served to intimidate 
auditors and create an abusive work environment. For example, we 
learned of verbal admonishments, reassignments, and threats of 
disciplinary action s^ainst auditors who spoke with or contacted our 
investigators, DOD investigators, or DOD contracting officials. 


‘ GAO, DCAA Audits: Allegations That Certain Audits at Three Locations Did Not Meet 
ProfessioJuU Standards Were Substantiated, GAO-OS-t)9-‘3T (Washington, D.C.: Sept. iO, 
2008 ). 
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At the time of the September 2008 hearing, we were conducting a broad 
assessment of DCAA's management environment and audit quality 
assurance structure at DCAA offices nationwide. Given the evidence 
presented at this heaiing, you requested that we expand our ongoing 
assessment. This report therefore presents (1) an assessment of DCAA’s 
management environment and quality assurance structure; (2) an analysis 
of DCAA’s corrective actions in response to our July 2008 report,^ the 
Under Secretary of Defense (Comptroiier/Chief Financial Officer)^ “tiger 
team" review,'* and the Defense Business Board study;^ and (3) potential 
legislative and other actions that could improve DCAA’s effectiveness and 
independence. 

To assess DCAA’s overall management environment and quality assurance 
structure, we analyzed DCAA’s mission statement and strategic plan, 
performance metrics, policies and audit guidance, and system of quality 
control. We also reviewed audit documentation for selected audits at 
certain field audit office (FAO) in each of DCAA’s five regions for 
compliance with generally accepted government auditing standards 
(GAGAS)* and other applicable standards. We selected 37 audits of 
contractor internal control systems performed by seven geographically 
disperse DCAA field offices within the five DCAA regions during fiscal 
years 2004 through 2006.’ TTiese were the most recently completed fiscal 
years at the time we initiated our audit. Our approach focused on DCAA 
offices that reported predominately adequate, or “clean," opiiuons on 
audits of contractor internal controls over cost accounting, billing, and 


* GAO, DCAA Audits: AUegations TTial Certain Audits ai Three Locations Did Not Meet 
Professional Standards Were Subsiantialed, GAD-OWiS? (Washington, D.C.: July 22, 2008), 

® Hereafter referred to as the DOD ComptroDer/CPO. 

* Under Secretary of Defense — Comptroller, Memorandum far Director Defense Contract 
Audit Agency, Subject: Implementation of Corrective Actions, (Washington, D.C.: Aug. 20, 
2008). 

* Defense Business Board, Report to the Secretary of Defense: Irulependenl Revieio Panel 
Report on the Defense Contract Audit Agency, October 2008. 

® GAO, Generally Accepted Government Auditing Standards, GAO-0;i-673Ci (Washington, 
D.C.: June 2003) and GA04)7-7;qG (Washington, D.C.: July 2007). 

’ In the case of follow-up audits, we also reviewed the documentation for the previous audit 
to gain an understanding of the scope of work and deficiencies identified in the prior audit 
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cost estimating systems issued in fiscal years 2005 and 2006.® We selected 
DCAA offices that report predominately adequate opinions on contractor 
systems and related internal controls because contracting officers rely on 
these opinions for tfiree or more years to make decisions on pricing and 
contract awards, and payment. For example, audits of estimating system 
controls support negotiation of fair and reasonable prices.® Also, the FAR 
requires contractors to have an adequate accounting system prior to award 
of a cost-reimbursable or other flexibly priced contract. Billing system 
internal control audit results support decisions to authorize contractors to 
submit invoices directly to DOD and other federal agency disbursing 
offices for payment without government review,” In addition, DCAA uses 
the results of internal control audits to assess risk and plan the nature, 
extent, and timing of tests for other contractor audits and other 
assignments. WTien a contractor has received an adequate opinion on its 
systems and related controls, DCAA would assess the risk for subsequent 
internal control and cost-related audits as low and would perform less 
testing on these audits. Although our selection of the seven offices and 37 
internal control audits was not statistical, it represented about 9 percent of 
the total 76 DCAA offices that issued audit reports on contractor internal 
controls and nearly 18 percent of the 40 offices that issued 8 or more 
reports on contractor internal controls during fiscal year 2006. Of the 37 
internal control audits we reviewed, 32 reports were issued with adequate 
opinions and 5 reports were issued with inadequate-in-part opinions. 

At the same seven EKJAA field offices, we selected an additional 32 paid 
voucher, overpayment, request for equitable adjustment, and incurred cost 
assignments that were completed during fiscal years 2004 through 2006 for 
review of supporting documentation to determine whether DCAA auditors 
were identifying and reporting contractor overpayments and billing 


* In selecting the seven DCAA offices, we considered a 2-year history of internal control 
audit results. The seven DCAA offices we selected reported adequate opinions on 89 
percent or more of the internal control reports they issued during fiscal year 2006. During 
fiscal year 2005, 4 of the 7 offices reported adequate opinions in 85 percent or more of the 
internal control reports they issued, and the other 3 offices issued adequate opinions in 50 
to 69 percent of the internal control audit reports they issued. 

® DCAA, Contract Audit Manual (CAM) 5- 1202. la and Defense Federal Acquisition 
Regulation Supplement (DFARS) 215.407-5. 

FAR §§ 16.104(h) and 16.301-3(a)(l). 

” FAR § 42.101 and DFARS S 242.803. 
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errors.'* In total, we reviewed 69 DCAA audits and cost-related 
assignments. To address our second objective, we assessed the status 
and analyzed several key actions that DCAA initiated as a result of our 
earlier invest^ation, including changes in performance metrics and policy 
and procedural guidance, as well as DCAA efforts in response to DOD 
ComptroDer/CFO and Defense Business Board” recommendations. To 
achieve our third objective to identify potential legislative and other 
actions that could improve DCAA’s effectiveness and independence, we 
considered DCAA’s current role and responsibilities; the framework of 
statutory authority for auditor independence in the Inspector General Act 
of 1978, as amended;’* best practices of leading organizations that have 
made cultural and organizational transformations; our past work on DCAA 
orgaruzational alternatives; GAGAS criteria for auditor integrity, 
objectivity, and independence; and GAO’s Standards for Internal Control 
In the Federal Govenunent'* on managerial leadership and oversight 

Throughout our audit, we met with the DCAA Director and DCAA 
headquarters policy, quality assurance, and operations officials and DCAA 
region and FAO managers, supervisors, and auditors. We also met with 
DOD Office of Inspector General (OIG) auditors responsible for DCAA 
audit oversight and DOD OIG hotline office staff. We conducted this 
performance audit from August 2006 through December 2007, at which 
time we suspended this work to complete our investigation of hotline 
complaints regarding audits performed at three DCAA field offices. We 
resumed our work on this audit in October 2008 and performed additional 


Contractor overpayments can occur as a result of errors made by paying offices, such as 
duplicate paymenis and payments in excess of amoimis billed, and contractor billing 
errors, such as using the wrong overhead rate, failing to withhold designated amounts on 
progress payments, duplicate billings, or biDing for unallowable cost. Recoveries of 
overpayments can be accomplished through refunds, subsequent billing or other 

actjustments to correct billing errors. 

” AlUtough we selected 73 assignments for review, two internal control assignments were 
assist audits and two cost related assignments were not completed assignments. As a 
result, we did not consider these four assignments in our an^ysis, and we discuss the 
results of our analysis of the ^ completed assignments that we reviewed. 

” On August 19, 2008, at the request of the DOD Defense, Comptroller, the Deputy 
Secretary of Defense established an independent review panel under the Defense Business 
Board (DBB) to review DCAA operatioits and make recommendaUons for improvements. 

Codified in an appendix to Title 5 of the United States Code (hereafter 5 U.S.C. App.). 

GAO, Standards for Internal CorUrol in the Federal Government, 

(Washington. D.C.; November 1999). 
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work through mid-September 2009 to evaluate DCAA’s quality assurance 
program during tiscal years 2007 and 2008, assess DCAA corrective actions 
on identified audit quality wealoiesses, and consider legislative and 
organizational placement options. During our assessment of DCAA 
corrective actions and analysis of legislative and organizational placement 
options for DCAA, we met with the former DOD Comptroller/CFXD to 
discuss plans for Office of Comptroller/CFO and Defense Business Board 
reviews, and we continued to meet with and obtain information from the 
new DOD Comptroller/CFO and his staff. We also met with Comptroller’s 
new DCAA Oversight Committee, which includes the Auditors General of 
the Army, the Navy, and the Air Force; the DOD Director of Defense 
Procurement and Acquisition Pobcy; and the DOD Deputy General 
Counsel for Acquisition. We obtained DOD and DOD OIG comments on a 
draft of this report DOD and DOD IG comments are summarized in the 
Agency Comments and Our Evaluation section of this report. DOD 
comments are reprinted in appendix IV and DOD OIG comments are 
reprinted in appendix V. We conducted our audit in accordance svith 
generally accepted government auditing standards. Those standards 
require that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and conclusions 
based on our audit objectives. We bebeve that the evidence obtained 
provides a reasonable basis for findings and conclusions based on our 
audit objectives. We performed our investigative procedures in 
accordance with quality standards set forth by the Council of the 
Inspectors General on Integrity and Efficiency (formerly the President’s 
Council on Integrity and Efficiency). A detailed discussion of our 
objectives, scope, and methodology is included in appendix III. 


Background 


DOD contract management continues to be a high-risk area for the 
government. With hundreds of billions of taxpayer dollars at stake, 
strong controls are needed to provide reasonable assurance that contract 
funds are not lost to fraud, waste, abuse, and mismanagement. Downsizing 
of contract administration personnel during the 1990s coupled with 
increased ccmtract spending since 2000 have exacerbated the risks 
associated with DOD contract management. Our work continues to 


” GAO, High-Risk Series: An Update, GAO-OJi-'iJTl (Washington, D.C.: January 2009). 
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identify significant problems with federal agency contract payments’* and 
contract management.'* 

DCAA is charged with a critical role in DOD contractor oversight by 
providing auditing, accounting, and financial advisory services in 
connection with the negotiation, administration, and settlement of 
contracts and subcontr^ts. DCAA also performs contract audit services 
and payment reviews for other federal agencies, as requested, on a fee-for- 
service basis. DCAA contract audit services are intended to be a key 
control to help assure that prices paid by the government for needed 
goods and services are fair and reasonable and that contractors are 
charging the government in accordance with applicable laws, regulations 
(e.g., Federal Acquisition Regulation (FAR) and Defense Federal 
Acquisition Supplement (DFARS), standards (e.g,, Cost Accounting 
Standards (CAS)), and contract terms. 

DCAA is headed by a director who reports to the Under Secretary of 
Defense (ComptroUer/CFO). DCAA’s placement provides the DOD 
ComptroUer/CFO with access to financial information on defense 
contracts and allows the Comptroller/CFO to make this information 
available to the Secretaiy and Deputy Secretaiy of Defense. In addition, it 
permits the ComptroUer/CPO to elevate policy issues concerning the 
scope of DCAA’s authority and level of resources. The DCAA Director is 


‘* GAO, Global War on Terrorism: DOD Needs to More Accurately Capture and Report the 
Coals of Operation Iraqi Freedom and Operation Enduring Freedom, (7AO-0()-302 
(Washington, D.C.: Mar. 17,2009); Centers for Medicare and Medicaid Services: Internal 
Control Deficiencies Resulted in Millions of Dollars of Questionable Contract Payments, 
GAO-08-5-1 (Washington, D.C.: Nov. 15, 2007); D^ense Contract Maruigement: DOD's Loch 
of Adherence to Key Conlracling Principles on Iraq Oil Contract Put Government 
Interests at Risk, GAO07-8Ji9 (Washington, D.C.: July 31,2007);/foTi/brrf Waste Treatment 
Plant: Department of Energy Needs to Strengthen Controls over Contractor Payments 
and Project Assets, G.A('M)7-rt88 (Washington, D.C.: July 20,2007); Iraq Contract Costs: 
DOD CoTisideration of Defense Contract Audit Agency’s Findings, GAO 06-1 132 
(Washington, D.C. Sept. 25, 2006); Department of Energy, Office of Worker Advocacy: 
Deficient Controls Led to Millions of Dollars in Improper and Questionable Payments to 
Contractors, GAO-OO-ivI? (Washington, D.C.; May 31, 2006); and Federal Bureau of 
Investigation: Weak Controls over Trilogy Project Led to Payment of Queslionable 
Contractor Costs and Missing Assets, GA04)6-J^()6 (Washington, D.C.: Feb. 28, 2006). 

GAO, Defense Acquisitions: Assessments of Selected Weapon Programs, (,'tA()-05)-,'12fiSP 
(Washington, D.C.: Mar. 30, 2009); Defense Management: Actions Needed to Overcome 
Long-standing Challenges v/ith Weapon Systems Acquisition and Service Contract 
Management, (.tAO(K^ 362T (Washington, D.C.: Feb. 1 1, 2009); and Defense Acquisitions: 
DOD's Increased Reliance on Service Contractors Exacerbates Long-standing Challenges, 
G A(>-08-r)2 IT (Washington, D.C.: Jan. 23, 2008). 
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responsible for day-to-day management of DCAA, development of strategic 
plans, audit guidance and procedures, and the quality of DCAA’s audit 
services. DCAA’s Contract Audit Manual (CAM)“ prescribes the 
standards, policies, and techniques to be followed by DCAA personnel in 
conducting contract audits. DCAA emphasizes and supplements CAM 
guidance through policy memorandums and other written notices, as well 
as through training and oral communications. 

The IG Act gives the DOD IG broad responsibilities to provide policy 
direction for and to conduct, supervise, and coordinate audits and 
investigations in DOD and in contractor operations, if warranted. DOD IG 
duties pertaining to DCAA include (1) providing policy direction for all 
DOD audits; (2) investigating fraud, waste, and abuse uncovered as a 
result of audits; (3) monitoring and evaluating adherence by all DOD 
auditors to audit policies, procedures, and standards; and (4) requesting 
assistance as needed from other auditors in DOD. As part of its audit 
policy and oversight responsibilities, the DOD IG reviews DCAA’s system 
of audit quality control on a 3-year basis that is intended to meet the 
requirements under GAGAS for a peer review. 


DCAA History and Audits of military contracts can be traced back to at least the World War I 

Organizational Structure initially, the various branches of the military had their own contract 

audit function and associated instructions and accounting rulings. 
Contractors and government personnel recognized the need for 
consistency in both contract administration and audit. The Navy and the 
Anny Air Corps made the first attempt to perform joint audits in 1939. By 
December 1942, the Navy, the Army Air Corps, and the Ordnance 
Department had established audit coordination committees for selected 
areas where plants were producing different items under contracts for 
more than one service. On June 18, 1952, the three military services jointly 
issued a contract audit manual that later became the DCAA CAM. 

In May 1952, Secretary of Defense Robert S. McNamara instituted “Project 
60” to examine the feasibility of centrally managing the field activities 


® DCAA, Cmlracl Audit Manual (CAM), DCAAM 7640.1. 
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concerned with contract administration and audit.^' An outcome of this 
study was the decision to establish a single contract audit capability within 
DOD and DCAA was established on June 8, 1965.^ At that time, DCAA’s 
mission to perform all necessary contract audits for IX)D and provide 
accounting and financial advisory services regarding contracts and 
subcontracts to all DOD components responsible for procurement and 
contract administration was established. The former Deputy Comptroller 
of the Air Force was selected as the DCAA Director and the former 
Director of Contract Audit for the Navy, was selected as the Deputy 
Director. DCAA was placed under management control of the Under 
Secretary of Defense (Comptroller), where it remains today. 

DCAA consists of a headquarters office at Fort Belvoir, Virginia, and six 
msyor organizational components — a field detachment ofHce, which 
handles audits of classified contracting activity, and five regional offices 
within the United States. The regional offices manage field audit offices 
(FAO), which are identified as branch offices, resident offices, or 
suboffices. Resident offices are located at larger contractor facilities in 
order to facilitate DCAA audit work. In addition, regional office directors 
can establish suboffices as extensions of FAOs to provide contract audit 
services more economically. A suboffice depends on its parent FAO for 
release of audit reports and other administrative support. In total, there 
are more than 300 FAOs and suboffices throughout the United States and 
overseas. During fiscal year 2008, DCAA employed about 3,600 auditors at 
more than 300 FAOs throughout the United States, Europe, the Middle 
East, and in the Pacific to perform audits and provide nonaudit services in 
support of contract negoUations related to approximately 10,000 
contractors. 


DCAA Audit and Nonaudit DCAA’s mission encompasses both audit and nonaudit services in support 

Services contracting and contract payment functions. FAR subpart 42.1, 

“Contract Audit Services," and DOD Directive 5105.36, D^ense Contract 


Project 60 also resulted in consolidation of the military services' contract management 
activities under the Defense Contract Management Agency (DCMA), formerly the Defense 
Contract Management Command (DCMC) within the Defense Logistics Agency. On March 
27, 2000, DCMC was established as DCMA under the authority of the Under Secretary of 
Defense (Acquisition, Techiwlogy, and Logistics). 

^ DOD, General Ptan: Consolidation of Department of Defense Contract Audit Activities 
into the Defense Contract Audit Agency (Feb. 17, 1965). 
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Audit Agency (DCAA), establish DCAA as the department’s contract audit 
agency^ and set forth DCAA’s responsibilities. 

FAR 42.101 prescribes contract audit responsibilities as submitting 
information and advice to the requesting activity, based on the analysis of 
contractor financial and accounting records or other related data as to the 
acceptability of the contractors’ incurred and estimated costs; reviewing 
the financial and accounting aspects of contractor cost control systems; 
and, performing other analyses and reviews that require access to 
contractor financial and accounting records supporting proposed and 
incurred costs. DOD Directive 5150.36 lists several responsibilities and 
functions that shall be performed by the DCAA Director,^* including; 

• "Assist in achieving the objective of prudent contracting by providing 
DOD officials responsible for procurement and contract 
administration" with financial information and advice on proposed or 
existing contracts and contractors, as appropriate." 

• “Audit, examine, and/or review contractors’ and subcontractors’ 
accounts, records, documents, and other evidence; systems of internal 
control; [and] accounting, costing, and general business practices and 
procedures: to the extent and in whatever manner is considered 
necessary to permit proper performance of other functions . . These 
other functions cover contract audit and nonaudit services. In addition, 
the Directive states that the DCAA Director shall perform such other 
functions as may be assigned by the Secretary and Deputy Secretary of 
Defense or the Under Secretary of Defense (Comptroller/CFO). 

• “Approve, suspend, or disapprove costs on reimbursement vouchers 
received directly from contractors, under cost-type contracts, 
transmitting the vouchers to the cognizant Disbursing Officer.” 

DCAA uses the term audit to refer to a variety of evaluations of various 
types of data." In fiscal year 2CX)8, DCAA reported that over 97 percent of 
its service work hours were spent on audits, meaning that DCAA has opted 
to provide nearly all of its services to the contracting and finance 


" DODD 5105.36, paragraph 4.2, reissued on February 28, 2002. 

" DODD 5106.36, paragr^hs 5.1 through 5. U. 

Contract administration responsibilities are set forth in FAR Subparts 42.2 and 42.3. 

"cam 2-001. 
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communities under applicable auditing standards, as discussed below. 
Table 1 lists several audit and nonaudit services provided by DCAA during 
the three phases of the contracting process — pre-award, contract 
administration, and close-out — and cites the statutory and regulatory 
provisions that authorize or establish the need to have DCAA perform the 
service. DCAA audits also support the contract payment process both 
directly and indirectly. For example, audits of contractor incurred cost 
claims and voucher reviews directly support the contract payment process 
by providing the information necessary to certify payment of claimed 
costs. ” Other audits of contractor systems, including audits of contractor 
internal controls, CAS compliance, and defective pricing, Indirectly 
support the payment process by providing assurance about contractor 
controls over cost accounting, cost estimating, purchases, and billings that 
the agency may rely upon when making contract decisions, such as 
determinations of reasonable and fair prices on negotiated contracts. For 
example, an accounting system deemed to be adequate by a DCAA audit 
permits progress payments based on costs to be made without further 
audit. “ 


Table 1: Examples of DCAA Audit and NonaudH Services 




Payment support 

Contract phase and 
assign n»ent 

Audit and Nonaudit services 

Contracting 

support 

Direct Indirect 

Pre-award phase: 

Accounting system* 

Audit; DCAA determines adequacy of the contractor’s accounting 
system prior to award of a cost-rein^rsabte or other flexibly 
priced contract. FAR § I6.30l-3(a)(i). 

X 

X 

Contractor accounting 
disclosure statements 

Audit; DCAA reviews the contractor's Disclosure Statement for 
adequacy and CAS compliance and determines whether the 
contractor's Disclosure Statement is current, accurate, and 
complete. DCAA also reviews Disclosure Statements during the 
post award phase if contractors revise them. FAR §§ 30.202 -Sfc), 
30.202-7 and 30.601(c). 

X 

X 

Estimating system* 

Audit; DCAA determines adequacy of contractor estimating 
systems. FAR § 15.407-5 and DFARS § 252.21 5-7002(d). (e). 

X 

X 


OisbuTsing oCHcers are authorized to make payments on the authority of a voucher 
certified by an authorized certifying officer, who is responsible for the legality, accuracy, 
and prc^riety of the payment 31 U.S.C. §§ 3325, 3521(a), and 3528(a). 

FAR §32.5034. 
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Payment support 

Contract phase and 
assignment 

Audit and NonaudH services 

Contracting 

support 

Direct 

Indirect 

Contract price 
proposals and forward 
pricing proposals® 

Audit; DCAA examines contractor records to ensure that cost or 
pricing data is accurate, current, and comf^ie and supports the 
determination of fair and reasonable prices. 10 U.S.C. §§ 2306a 
and 2313 (000) and 41 U.S.C. § 254d (other agencies); FAR 
Subpart 15.4 (esp. FAR § 1S.404-2(c)) and § S2.21S-2(c); and 
DFARS § 215.404-1. 

X 


X 

Financial liaison 
advisory services' 

Nonaudit; DCAA Director establishes and maintains liaison 
auditors and fmancial advisors, as appropriate, at major procuring 
and contract administration offices. These services are also 
provided during the post-award phase, as needed. DODD 

5105.36, paras. 7.1,1 and 5.9. 

X 


X 

Post award/administration phase: 

interna! control system 
audits (generally) 

Audit: DCAA reviews the nnanciat and accounting aspects of the 
contractor's cost control systems, including the contractor's 
internal control systems. FAR § 42.101(a)(3) and DFARS § 
242.7501. 

X 


X 

Billing system audits* 

Audit: DCAA determines adequacy of contractors' billing system 
controls and reviews accuracy of praid vouchers. DCAA uses audit 
results to support approval of contractors to participate in the 
direct-bill program. FAR § 42.101 and DFARS § 42.803 (b)(i)(C). 

X 

X 


Purchasing system 
review b 

Audit: DCAA determines adequacy of a contractor's or 
subcontractor's purchasing system. FAR Sutftart 44.3. 

X 


X 

Progress payments® 

Audit: DCAA verifies amount claimed, determnes allowability of 
contractor requests for cost -based progress payments, and 
determines if the payment will result in undue financial risk to the 
government. FAR §§ 32.503-3. 32.503-4, and 52.232-16. 

X 

X 


incurred cost claims* 

Audit; DCAA determines acceptability of the conuactors' claimed 
costs incurred and submitted by contractors for r^mbursement 
under cost-reimbursable, fixed-price incentive, and other types of 
flexibly priced contracts and compliance with contract terms, FAR, 
and CAS, if applicable. FAR §§ 42.101. 42.803(b). and DFARS § 
242.603. 

X 

X 


Billing rates and Ttnal 
indirect cost rates* 

Audit; DCAA establishes billing rates for interim itxjireci costs and 
final indirect cost rates. FAR §§ 42.704. 42.705 and 42.705-2 and 
DFARS § 42.705-2. 

X 

X 


Defective pricing® 

Audit; DCAA determines the amount of cost adjustments related 
to defective pricing. See above authorities to audit contractor cost 
and pricing data and FAR § 15-407-1. 

X 


X 

CAS compliance® 

Audit: DCAA determines contractor and subcontractor compliance 
with CAS set forth in 48 CFR § 9903.201 acKf detenmines cost 
impacts of noncompliance. FAR §§ 1.602-2. 30.202-7, and 
30.601(C). 

X 

X 


Other specially 
requested services 

Audit and nonaudit services: DCAA conducts perfcsmance audits 
and other audits based on requests from DOD corr^nents and 
requests from other federal agencies. DOD Directive 5105.36, 

Sec. 5. 

X 


X 
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Payment support 

Contract phase and 
assignment 

AudK and Nonaudit services 

Contracting 

support 

Direct Indirect 

Paid voucher reviews’ 

Nonaudit services: DCAA reviews vouchers after payment to 
support continued contractor participation in the direct bill 
program. CAM 6-1007.6; FAR § 42.803; DFARS § 242.803; 

DODD 5105.36, paras. 5.4 and 5.5; and OOO Financial 
Management Regulation (FMR), vol. 10, ch. 10, para. 100202. 

X 

X 

Approval of vouchers 
prior to payment* 

Nonaudit: DCAA reviews and apjyoves coniractor interim 
vouchers for payment and suspends payment of questionable 
costs. FAR § 42.803; DFARS § 242.803(b)(i)(B); DOD Directive 
5105.36, paras. 5.4 and 5.5; and DOD FMR vol. 10, ch. 10, para. 
100202. 

X 

X 

Overpayment reviews* 

Non audit services: At the request of the contracting officer. DCAA 
reviews contractor data to identify potential contract 
overpayments. FAR §§ 2.605, 52.216-7(g), (h)2. 

X 

X 

Close-out/termination phase: 

Contract close-out 
procedures and 
audits* 

Audit: DCAA reviews final completion vouchers and the 
cumulative allowable cost worksheet and may review contract 
closing statements. DFARS § 242.603(b)(i)(0). 

X 

X 


Soufce GAOanatyse. 


‘tndicaies OCAA audit and nonaudii services covered in this audit. 

‘Indicates types of audits covered in our prior investigation (GAO-06-Br>7). We revievt'ed progress 
payment and coittraci close-out audits that related to audits in our earlier investigation or this audit 
where the auditors considered the evidence in those audits. 


Importance of Audits in DCAA policy states" that it follows gagas’" when conducting audits. 

Accordance with GAGAS These standards provide a framework for conducting high quality 

government audits and attestation engagements. These standards also 
provide guidelines to help government auditors maintain competence, 
integrity, objectivity, and independence in their work and require that they 
obtain sufficient evidence to support audit conclusions and opinions. 
When auditors are required to follow GAGAS or are representing to others 
that they followed GAGAS, they should follow all applicable GAGAS 
requirements and should refer to compliance with GAGAS in the auditor’s 
report.” Most DCAA audits are performed as attestation audits under 
GAGAS. For attestation audits, GAGAS incorporates the American 


" CAM, 2-101. Except where stated otherwise in this report, various types of evaluations 
entailing different levels of assurance that DCAA refers to as audits — such as examinations, 
attestations, and reviews — were subject to GAGAS. 

“’GAO-aVbntG, §1.01, and GAO-07-73iG, §1.03. 

”GAC)-07-731G,§1.1I. 
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Institute of Certified Public Accountants (AICPA) general standard on 
criteria, and the field work and reporting standards and the related 
Statements on Standards for Attestation Engagements (SSAE), unless 
specifically excluded or modified by GAGAS.” DCAA also conducts 
performance audits upon request. This report addresses DCAA attestation 
audits and related supporting assignments. 

GAGAS state that the public expects auditore to observe the principles of 
serving the public interest and maintaining the highest degree of integrity, 
objectivity, and independence in discharging their professional 
responsibilities. Serving the public interest and honoring the public trust 
are critical when performing government audits. Auditors increase public 
confidence when they conduct their work with an attitude that is 
objective, fact-based, nonpartisan, and non-ideological with regard to 
audited entities and users of the auditors’ reports. Auditors also should be 
intellectually honest and free of conflicts of interest in disch^ging their 
professional responsibilities.” Management of the audit organization sets 
the tone for ethical behavior throughout the orgaiuzation by maintaining 
an ethical culture, clearly communicating acceptable behavior and 
expectations to each employee and creating an environment that 
reinforces and encourages ethical behavior throughout all levels of the 
organization. ** The credibility of auditing in the government sector is 
based on auditors’ objecfivity and integrity in discharging their 
professional responsibilities.” 


” G.^(>-0:^673G, §6.01, and GAC>-07-7?ilG, § 6.01. 
“GAO-07-731G. §§ 2.06 through 2.10. 
”GAO-07-731G,§2.01. 

”GAO-07-7:dG,§2.10. 


Page L3 


GAO-09-468 DCAA Audit Environment 


VerDate Nov 24 2008 


13:37 Apr 18, 2011 Jkt 053841 


PO 00000 Frm 00155 Fmt6601 Sfmt 6601 


P:\DOCS\53841.TXT SAFFAIRS PsN: PAT 



152 


Nationwide Audit 
Quality Problems Are 
Rooted in DCAA’s 
Poor Management 
Environment 


We found audit quality problems at DCAA offices nationwide, as 
demonstrated by serious quality problems in the 69 audits and cost-related 
assignments we reviewed, DCAA’s ineffective audit quality assurance 
program, and DCAA’s resci^on of 80 audit reports in response to our 
work. * Of ffte 69 audits and cost-related assignments we reviewed for this 
report, 65 exhibited serious GAGAS or other deficiencies similar to those 
found in our prior investigation, including compromise of auditor 
independence, insufficient audit testing, and inadequate plarming and 
supervision, Althou^ not as serious, the remaining four audits also had 
GAGAS compliance problems. The 69 audits and cost-related assignments 
we reviewed included 43 audits that DCAA reported were performed in 
accordance with GAGAS and 26 non-GAGAS cost-related assignments, 
including 10 overpayment and 16 paid voucher assignments. According to 
DCAA officials, DCAA rescinded the 80 audit reports because the audit 
evidence was outdated, insufficient, or inconsistent with reported 
conclusions and opinions and reliance on the reports for contracting 
decisions could pose a problem. Nearly one third (24) of the 80 rescinded 
reports relate to unsupported opinions on contractor internal controls, 
which were used as the basis for risk-assessments and planning on 
subsequent internal control and cost-related audits. Other rescinded 
reports relate to CAS compliance and contract pricing decisions. Because 
the conclusions and opinions in the rescinded reports were used to assess 
risk in planning subsequent audits, they impact the reliability of hundreds 
of other audits and contracting decisions covering billions of doUais in 
DOD expenditures. We found that DCAA’s focus on a production-oriented 
mission led DCAA management to establish policies, procedures, and 
training that emphasized performing a large quantity of audits to support 
contracting decisions over audit quality. An ineffective quality assurance 
structure compounded this problem. 


Audit Quality Problems We found audit quality problems, including GAGAS compliance problems, 
Found in All Audits GAO ^ audits of contractor internal controls and the 4 incurred cost 

Reviewed ^ request for equitable a^ustment audits we reviewed at 7 FAOs 

across the 5 DCAA regions covered in this audit. In addition, none of the 
26 cost-related assignments we reviewed from these same FAOs included 
sufficient testing to identify contractor overpayments and billing errors. 


“ According to documentation provided by DCAA as of the end of July 2009, the 80 
rescinded reports include 62 reports relat^ to findings in our July 2008 investigative report 
and 18 reports related to this audit. 
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For additional details on our an^ysis of these DCAA audits and 
assignments, including narrative case-studies, see appendixes 1 and il. 

Internal Control Audits DCAA performs attestation audits of contractors’ systems for cost 

accounting, estimating, and billing to gather evidence to express an 
opinion on the adequacy of the contractor’s systems and related internal 
controls for compliance with applicable laws ^d regulations ^d contract 
terms. A contractor must have an adequate accounting system to be 
awarded a government cost-reimbursement contract, an adequate billing 
system to submit invoices for payment without government review, and an 
acceptable estimating system to support a contracting officer’s approval of 
pricing proposals. A secondary objective of DCAA’s audits of contractor 
systems and controls is to determine the degree of reliance that can be 
placed on the contractor’s internal controls as a basis for planning the 
scope of other related audits. For example, if a contractor receives an 
adequate opinion on various systems control audits, auditors assess risk as 
low and reduce the level of testing on subsequent internal control and 
cost-related audits, including audits of contractors’ annual incurred cost 
claims. Although the reports for all 37 audits of contractor internal 
controls that we reviewed stated that the audits were performed in 
accordance with GAGAS, we found GAGAS compliance issues with all of 
these audits. Examples of GAGAS compliance issues we found included: 

Independence issues. For 7 audits we reviewed, DCAA independence 
was compromised because auditors provided material nonaudit services 
to a contractor they later audited; experienced access to records problems 
that were not fully resolved; or significantly delayed report issuance in 
order to allow the contra<rtors to resolve cited deficiencies. GAGAS state 
that auditors should be free from influences that restrict access to records 
or improperly modify audit scope.” 

Insufficient evidence. We found that 33 of the 37 internal control audits 
did not include sufficient testing of internal controls to support auditor 
conclusions and opinions. GAGAS for examination-levei attestation 
engagements require that sufficient evidence be obtained to provide a 
reasonable basis for the conclusion that is expressed in the report.’® 
However, our review of audit documentation often found that only two, 
three, or sometimes five transactions were tested to support audit 


” See GA(>1»:J-07;JG, § 3-19, and CiAO-OT-T^UCi, § 3.10. 
** GAO-m-(iTiQ, § 6.04b. 
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conclusions, and the audit documentation did not contain a justification 
for the small sample sizes selected for testing. For internal control audits, 
which are relied on for 2 to 4 years and sometimes longer, the auditois 
would be expected to test a representative selection of transactions across 
the year and not transactions for just one day, one month, or a couple of 
months.® For many controls, the procedures performed consisted of 
documenting the auditois' understanding of controls, and the auditors did 
not test the effectiveness of the implementation and operation of controls. 

Generally, the basis for an auditor’s determination of sufficient testing 
should include (1) an adequate risk assessment, taking into consideration 
any auditor alerts arising from related audits, past findings, and corrective 
actions; (2) the contractor’s overall control environment; and (3) the 
nature and volume of transactions and associated materiality and risk of 
error. For example, decisions on sufficient testing of contractor internal 
controls would include consideration of the number and types of contracts 
or proposals; the nature, dollar amount, and volume of transactions; and 
key control attributes or special characteristics of the transactions. 
Further, a representative selection would include a representative number 
of transactions from a population of transactions representing a 
reasonable period of time, in order for test results to support conclusions 
and opinions on the overall adequacy of the contractor’s systems and 
effectiveness of the related controls. For example, under the GAO/PCIE 
Financial Audit Manual,*^ the minimum sample size for an attribute 
sample of a control would be 45 items. 

Reporting problems. According to GAGAS, audit reports should, among 
other matters, identify the subject matter being reported and the criteria 
used to evaluate the subject matter. Criteria identify the required or 
desired state or expectation with respect to the program or operation and 
provide a context for evaluating evidence and understanding the findings.** 
None of the 37 internal control audit reports we reviewed cited specific 
criteria used in individual audits. Instead, the reports uniformly used 
boilerplate language to state that DCAA audited for compliance with the 
“FAR, CAS, DFARS, and contract terms.” As a result the user of the report 


® AICPA S(atemenls on Auditing Standards. AU 350, and Audit and Accounting Guide: 
Audit Sampling, §§ 3. 14, 3.29^.34, 3.58, and 3.6!. 

“ GAO/PCIE, Financial Audit Manual, GA(WI8Ji85G (Washington, D.C.; July 2008). 
*'G.AOJ)7-7810, §4.16, 
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does not know the specific Federal Acquisition Regulation (FAR), Cost 
Accounting Standards (CAS), or contract terms used as criteria to test 
contractor controls. This makes it difficult for users of the reports to 
determine whether a particular report provides the level of assurance 
needed to make contracting decisions. 

The lack of sufficient support for the audit opinions on 33 of the 37 
interned control audits we reviewed rendered them unreliable for decision 
making on contract awards, direct billing privileges, the reliability of cost 
estimates, and reported direct cost and indirect cost rates. For example, 
the FAR requires** government contracting officers to determine the 
adequacy of a contractor’s accounting system before awarding a cost- 
reimbursement contract. Of the 9 audits of contractor accounting system 
internal controls that we reviewed, only two of the audits included 
sufficient testing to support DCAA’s audit opinion that internal controls 
over the contractors’ accounting systems were adequate. In addition, none 
of the 20 audits of contractor billing system internal controls we reviewed 
contained sufficient testing of controls to support the reported opinions. 
Adequate opinions on billing system audits are the basis for DCAA 
decisions to approve contractors for the direct bill program, whereby 
contractors submit invoices directly to a government disbursing office 
without prior review." Four of the 6 audits of contractor estimating 
system controls that we reviewed did not include sufficient testing to 
support the reported opinions. DOD requires" that large contractors have 
acceptable estimating systems. Opinions on contractor estimating systems 
support DCAA decisions on the extent of testing performed on contract 
proposals. Neither of the two internal control audits of contractor indirect 
and other direct costs we reviewed included sufficient testing to support 
reported opinions. As shown in figure I, at the time these audits were 
performed, DCAA policy guidance provided for three categories of 
opinions on internal control audits. This policy provided for different 
opinions and criteria forjudging them based on the severity of the 
problems identified. Professional standards have long recognized different 
levels of severity with regard to reporting deficiencies and material 
weaknesses in internal controls. 


" FAR §§ 16.104(h) and 16.301-3(aXl). 

" FAR § 42.101 and DFARS § 242.803(bXi)(C). 
" DFARS § 215.407-5-70; see FAR § 15.407-5. 
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Figure 1: DCAA Opinions on Contractor internal Control Systems Audits 


Risk DCAA opinion 

Criteria 

Resultant actions 

Adequate 

liow 

No significant 
deficiencies were 

identified in the audit 

Scope <rf future audits wili be decreased based on assurance provided by 
adequate controls. 

} ; inadequate in part 

Audirore ideniiRed oilct . 

Of more significant • 

' deficiencies that affect - 
parts of the contractor's, 
system 

. , ■ CofiBactdr is required to make improvements, and DCAA is to perform foilow-up 
• testing within 6 'months; 

. . inadequate in pan opinion also requires expanded audit scopes on future and i 
ajnewTBftt audits until the contractor’s corrective actions are confirmed oy 



Source: QAO sxalysui o< OCAA poHcy 


Supervisors of the DCAA internal control audits we reviewed dropped 
auditor findings of significant deficiencies from the audit reports or 
treated them as suggestions for improvement without adequate support, 
including instances of FAR noncompliance that should have been reported 
as material weaknesses. In some cases, auditors reported “inadequatedn 
part” opinions when the severity of the deficiencies or material 
weaknesses identified would have called for “inadequate" opinions. 

On December 19, 2008, DCAA revised its policy to eliminate the 
“inadequate-in-part” opinion and the requirement to report suggestions for 
improvement." The new DCAA policy defines “significant 
deficiency/material weakness” as an internal control deficiency that 
(1) adversely affects the contractor’s ability to initiate, authorize, record, 
process or report government contract costs in accordance with 
applicable government contract laws and regulations; (2) results in a 
reasonable possibility that unallowable costs will be charged to the 
government; and (3) the potential unallowable cost is not clearly 
immaterial. The new DCAA policy also establishes new guidance on 


^*DCAA, “Audit Guidance on Significant Deficiencies/MatenaJ Weaknesses and Audit 
Opinions on Internal Control Systems,” 08-PAS-043R (Dec. 19, 2008). 
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reporting audit opinions on contractors’ internal control systems. For 
example, the new DCAA policy states that audit reports that identify any 
signiflcant deficiencies/material weaknesses in contractors’ internal 
control systems will include opinions that the systems ^e “inadequate." 
The policy notes that the contractor’s failure to accomplish any control 
objective tested in DCAA’s internal control audits will or could ultimately 
result in unallowable costs being charged to government contracts, even 
when the control objective does not have a direct relationship to charging 
costs to government contracts. As an example, the policy notes the control 
objective related to ethics and integrity is not directly related to charging 
costs to government contracts, but that the contractor’s failure to 
accomplish the control objective creates an environment that could 
ultimately result in mischarging to government contracts. 

By eliminating the “inadequate-in-part" opinion, the new policy does not 
recogruze different levels of severity and could unfairly penalize 
contractors whose ^sterns have less severe deficiencies by giving them 
the same opinion — "inadequate" — as contractors having material 
weaknesses or serious deficiencies that in combination would constitute a 
material weakness. 

At the time we finalized our draft report for DOD comment, DCAA had 
rescinded 18 of the 33 audits of contractor internal controls that we 
determined did not contain sufficient testing to meet GAGAS.** Unreliable 
audit opinions on contractor internal controls pose a significant risk 
because DCAA generally performs these audits on a 2- to 4>year cycle and 
the audit results are relied on for several years to make decisions on 
testing in various audits of contractor internal controls and cost-related 
assignments. In response to our earlier investigation in November 2008, 
DOD added DCAA audits not meeting professional standards to its list of 
material weaknesses.*’ Table 2 provides details on five case studies that 
are typical of the flawed internal control audits that we reviewed during 
the course of our work. For more detail on the internal control audits we 
reviewed, see appendix I. 


** Under its decentralized management environment, DCAA headquarters obtains field 
office agreement to rescind audit reports that do not meet GAGAS. 

*’ DOD, Fiscal Year 2008 Agency ^nanci<[l Report, Department of D^ense (Washington, 
D.C.: Nov. J7. 2008). 
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Table 2: Summary of Five Selected Internal Control Audits 


Case Region Audit type 

1 Western Billing system (2004) 


2 Western Accounting system 
(2004) 


Case details 

~ DCAA aitditors irtappropriately ptann^ and performed a billing system auditof a 

federally funded research and development center (grantee) with $1 .5 billion in annual 
funding. The grantee does not have a “billing system.'' 

• The grantee is funded by a line of credit, which provides for cash draws and 
transactbn reporting by the grantee's accounting system. 

• DCAA auditors spent 530 hours revising Single Audit Act cash management audit 
documentation to address procedures required in DCAA's standard audit program for 
billing system interrral conirr^s and developed a billing system audit report, when the 
auditors could have simply forwarded the results of work on the grantee's cash 
management system performed under the Single Audit Act io the federal agency's 
buying commartd. 

• As a result of oir review. DCAA reassessed the need to perform a billing system audit 
for the grantee and determined that it would rely on the Single Audit reports in the 
future. 

~ This audit involving accounting controls for one of the five largest DOD contractors 
working in Iraq was initialed in November 2003. 

• In September 2005. after nearly 2 years of audit work. DCAA provided draft findings 
and recommendations to the contractor that included 8 significant deficiencies in the 
contractor's accounting design and operation. 

• The contractor objected to the findings, stating that the auditors did not fully 
understand its new pcrficies and procedures, which were just being developed for the 
fast track effort in Iraq. 

« Following the contractor's objections, various supervisory auditors directed the 

auditors to re^se and delete some workpapers, generate new workpapers, and in one 
case, copy the signature of a prior supervisor onto new workpapers making it appear 
that the prior supervisor had approved a revised risk assessment. 

• On August 31, 2006, after dropping 5 signiRcant deficiencies and dotvngrading 3 
significant deficiencies to suggestions for improvement, DCAA reported an "adequate" 
opinion on the contractor's accounting system without adequate audit evidence for the 
changes. 

« The interim audit supervisor, who instructed the lead auditor to copy and paste the 
prior supervisor's name onto key risk assessment workpapers, was subsequently 
promoted to be the Western Region's quality assurance manager where he served as 
quality control check over thousands of audits, including those GAO reported on last 
year. 

• In April 2007. the Special IG for Iraq Reconstruction (SIGIR) reported that despite 
being paid $3 million to ccvnplete the renovation of a building in Iraq, the contractor's 
work led to plumbing failures and electrical Fires in a building occupied by the Iraqi 
Civil Defense Directorate. 


• DCAA rescinded the audit report on December 2, 2008, 
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Case Region Audit type Case details 

3 Eastern Billing system (2005) • In May 2005. DCAA reported an inadequate-in-part opinion on the billing system 

internal cor^rob of a second of the five largest DOD contractors. 

• After isswng the report, OCAA auditors helped the contractor develop policies and 
procedures related to accounts receivable, overpayments, and system monitoring 
before performing a required follow-up audit— a serious impairment to auditor 
independence. 

• In June 2006. DCAA reported an adequate opinion on the contractor's billing system 
internal controls, including the policies and procedures DCAA helped the contractor 
develop. 

• As a result of GAO's review. OCAA rescinded the follow-up audit report on March 6, 

2009. 

4 Central Billing system • This audit, which was initialed in July 2005, covered a new billing system at a 

business segment of another of the five largest DOD contractors. Although DCAA 
' ^ considers new systems to be high-risk and requires increased testing, auditors 

deleted key audit steps related to contractor policies and internal controls over 
progress payments from the standard audit program without explanation and 
performed linle or no testing of the contractor's billing controls. 

• The contractor ot^ecied to requests for documentation to test whether billing clerks 
had received necessary training. 

• One auditor told GAO he did not perform other tests because “the contractor would 
not appreciate it.' 

« The auditors provided A'aft findings and recommendations to the contractor in 
February 2006 that included six suggestions to improve the system related to the 
need for internal audits, oversight of subcontractor accounting systems, and 
improvements in policies and procedures and desk instructions. 

• Instead of issuing the report, when audit work was completed and noting the status of 
any contractor actions to address rdeniified control weaknesses, the auditors 
monitored contractor corrective aciions for 7 months, dropping the two suggestions for 
improvement related to int^nal audits and monitoring subcontractor accounting 
systems. The failure to monitor subcontractor accounting systems should have been 
considered a significant deficiency. 

• On September 15. 2(Xi6, OCAA reported an “adequate" opinion on the contractor’s 
billing system. 

• Following GAO's review of this audit. DCAA rescinded the audit report on February 
10, 2009. 
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Case Region Audit type 

Case details 

5 Central Billing system (2006) 

• A fraud investigation by the Army's Criminal Investigative Division was under way at 
the time DCAA performed this contractor's billing system audit. The FAQ was aware 
of the substance of the Army's investigation. 

• The auditor requested iiKfeases in budgeted audit hours to perform increased testing 
because of fraud risk and the contrartor's use of temporary accounts for charging 
costs that had not y^ been authorized by the contracting officer. 

« The auditor drafted an "inadequate'' opinion on the contractor's billing system, which 
was overturned by the sup^visor and FAQ manager. 

« Despite a reported S2.6 million in fraud for this contractor, DCAA reported an 
"inadequate-in-parT opinion related to 3 significant deficiencies in the contractor's 
billing system on August 31. 2(X)5, and an "adequate" opinion on September 11, 

2006, related to a foilow-up audit. 

• The auditor, whose performance appraisal was lowered for performing too much 
testing and exceeding budgeted audit hours, was assigned to and then removed from 
the follow-up audit. The auditor left DCAA in March 2007. 

• Following GAO's review, DCAA rescinded both audit reports on November 20, 2008. 


Sovce: GAO anafyvs of DCAA au(H oocumemanon ana auOitot ne«views 


Cost-Related Assignments Th® 32 cost-related assignments we reviewed did not contain sufficient 

testing to provide reasonable assurance that overpayments and billing 
errors that might have occurred were identified As a result, there is little 
assurance that any such errors, if they occurred, were corrected and that 
related improper contract payments, if any, were refunded or credited to 
the government. Contractors are responsible for ensuring that their 
billings reflect fair and reasonable prices and contain only allowable costs, 
and taxpayers expect DCAA to review these billings to provide reasonable 
assurance that the government is not paying more than it should for goods 
and services. Further, we found that DCAA does not consider some cost- 
related assignments to be GAGAS audits, even though these assignments 
are used to provide assurance of the reasonableness of contractor billings, 
for example: 

Paid voucher reviews. DCAA performs annual testing of paid vouchers 
(invoices) to determine if contractor voucher preparation procedures are 
adequate for continued contractor participation in the direct-bill 
program." Under the direct-bill program, contractors may submit their 
invoices directly to the DOD disbursing officer for payment without 
further review. Although DCAA does not consider its reviews of contractor 


" IXJAA does not perform paid voucher reviews during the year that It performs an audit of 
the contractor’s bilUng system internal controls. 
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paid vouchers to be GAGAS engagements; it has not determined what 
standards, if any, apply to these assignments. In addition, for the 16 paid 
voucher assignments we reviewed, we found that DCAA auditors failed to 
comply with CAM guidance.” Rather than documenting the population of 
vouchers, preparing sampling plans, and testing a random (statistical) 
sample, auditors generally did not identify the population of vouchers, did 
not create sampling plans, and made a small, nonrepresentative selection 
of as few as one or two invoices for testing to support conclusions on their 
work. Even when DCAA auditors tested 20 or 30 invoices, they did not test 
billing controls or review supporting documentation for goods and 
services purchased. Instead, the auditors performed limited procedures 
such as determining whether the vouchers were mathematically correct 
and included current and cumulative billed amounts. Based on this limited 
work, the auditors concluded that controls over invoice preparation were 
sufficient to support approval of the contractors’ direct billing privileges. 
However, the limited work performed does not provide assurance that 
contractor billings are accurate and comply with applicable laws, the FAR, 
CAS, and contract terms. This is of particular concern because we 
determined that Defense Finance and Accounting Service (DFAS) 
certifying officers rely on DCAA voucher reviews, and they do not repeat 
review procedures they believe to be performed by DCAA. 

Professional literature contains guidance to help auditors deteimine the 
level of testing that shotiid be perlormed to obtain sufficient, appropriate 
evidence to support a conclusion that internal controls are effectively 
designed, implemented, and operating effectively. Inquiry alone does not 
provide sufficient, 2 q>propriate evidence to support a conclusion about the 
effectiveness of a control. Some of the factors that affect the risk 
associated with a control include 

• the nature and materiality of misstatements that the control is intended 
to prevent, 

• the inherent risk associated with the related account(s) and 
assertion(s), 

• whether there have been changes in the volume or nature of 
transactions that might adversely affect control design or operating 
effectiveness, 


” CAM 6-1007. 
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• the degree to which the control relies on the effectiveness of other 
controls (i.e., infonnation technology controls), 

• the competence of personnel who perform the control or monitor its 
performance, and whether there have been changes in key personnel 
who perform the control or monitor performance, and 

• whether the control relies on performance by an individual or is 
automated (an automated control would generally be expected to be 
lower risk if relevant IT general controls are effective).” 

Professional standards^' state that the auditor should focus more attention 
on the areas of highest risk. As the risk associated with the control being 
tested increases, the evidence that the auditor should obtain increases. In 
addition, the GAO/PCIE Financial Audit Manual provides guidance on 
sampling control tests that would be relevant to DCAA testing of 
contractor invoices." The auditor should assess risk in determining the 
control attributes to be tested and select a sample that the auditor expects 
to be representative of the population. Attribute sampling requires random 
or systematic, if s^propriate, selection of sample items without 
considering the transactions’ dollar amount or other special 
characteristics. To determine the sample size, the auditor uses 
professional judgment to determine tlvee factors— confidence level,” 
tolerable rate (maximum rate of deviations from the prescribed control 
that the auditor is willing to accept without altering the preliminary 
control risk), and expected population deviation rate (expected error 
rate).*^ 


” AU § 350.19 and SSAE §§15.64 and 15.69. 

" AU §§ 350.07 through 350.14. 

” GAO-08-58r>tf. § 450. 

” Confidence interval is the probability associated with the precision, that is, the 
probability that the true misstatement is within the confidence interval. 

"For example, for a confidence level of 90 percent and a tolerable rate of 5 percent, a 
sample size of 45 transacUons would have an acceptable number of deviations of zero and 
asamplesizeof 78traitsacUons would have an acceptable number of deviations of one. For 
the same confidence level of 90 percent and a tolerable rate of 10 percent, a sample size of 
45 would have an acceptable number of deviations of one and a sample size of 78 would 
have an acceptable number of deviations of four. 
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Finally, the American Institute of Certified Public Accountants (AICPA) 
Audit and Accounting Guide: Audit Sampling^^ (Audit Guide) contains 
attestation guidance on the application of SSAEs in specific 
circumstances, Including engagements for entities in specialized 
industries. The Audit Guide states that an auditor using nonstatistical 
sampling is not required to compute the sample size using statistical 
theory. However, sample sizes of statistical and nonstatistical samples 
ordinarily would be comparable when the same sampling parameters are 
used.* 

Overpayment assignments. DCAA intends these audits to verily that 
contractors have billing procedures and internal controls in place to 
identify and resolve contractor overpayments in a timely manner. DCAA 
guidance states tlial these engagements should be conducted in 
accordance with GAGi^ to the extent applicable under the 
circumstances.” However, none of the 10 overpayment assignments we 
reviewed were performed or reported as GAGAS engagements. We found 
that auditor judgments about the population and selection of transactions 
for these assignments did not provide a representative basis for testing 
and concluding on contractor controls over billings and payments 
received. For example, for the 10 assignments we reviewed, the auditors 
selectively reviewed an accounts receivable aging report to identify 
overpayments and determine if they had been resolved. The auditors did 
not attempt to identify the population of transactions subject to 
overpayments and over billings during the year, and they did not 
document their rationale for selecting a particular dollar threshold, 
number of transactions, or time period for testing contractor invoices. Our 
assessment of these assignments includes the same concerns regarding 
insufficient evidence to support the auditors’ conclusions as discussed 
above for annual testing of paid vouchers. As a result, this work does not 
provide reasonable assurance that contractors have adequate controls in 
place to identify and correct overpayments and billing errors and make 
appropriate, timely refunds and adjustments. 


* Th<; AICPA Axtdit Guide is an interpretive publication pursuant to AT section 50, SSAE 
Hierarchy (AICPA, Professiorud. Standards, vol. I). 

* AICPA Audit Guide § 1-17, and AU § 350.23. Statements on Auditing Standards (SAS) 39 
is referred to as AU 350. 

” DCAA, “Audit Pcogram; Audit of Contractor Overpayments,” (Activity Code 17310), April 
2004, September 2007, and May 2008. 
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Incurred cost audits. The purpose of incurred cost audits is to examine 
contractors’ cost representations and opine on whether the costs are 
allowable, allocable to government contracts, and reasonable in 
accordance with the contract and applicable government acquisition 
regulations. “ DCAA performs these audits as GAGAS attestation 
engagements. For the four incurred cost audits we reviewed, we found 
that the auditors did not adequately document their judgments about 
control risk or the sampling and test methodologies used. In addition, we 
found that the auditors traced claimed pool and base costs (indirect costs) 
to the contractor’s accounting books and records to determine their 
accuracy and allowabili^. However, the auditors did not perform 
sufficient, detailed testing of support for claimed indirect and direct costs. 
The scope of work performed was not sufficient to identify claimed costs, 
if any, that were not adequately supported or unallowable costs, if any, 
that should have been questioned. 

In addition to the testing failures we identified on the 32 cost-related 
assignments, several additional issues came to our attention during our 
review; 

Exempting f^om professional standards certain assignments that 
were used as support for internal control system audits. We noted 
that paid voucher reviews and overpayment assignments, which were used 
to support direct-bill decisions and billing system audits, were not 
performed under GAGAS, even though some of them used the same 
terminology as GAGAS engagements to describe the work performed, 
including “comprehensive examination” and “audit." According to DCAA's 
CAM and DCAA officials, paid voucher reviews and most overpayment 
assignments are not intended to meet GAGAS standards. However, paid 
voucher reviews are intended to serve as audits of contractor payments, 
and DCAA’s standard audit program for overpayment assignments states 
that the assignments are to be performed in accordance with GAGAS, 
unless there are specific exceptions. When these types of assignments are 
not conducted under professional standards, it is important for the report 
to clearly state the procedures performed and the intended uses of the 
report, such as verifying compliance with certain FAR requirements, in 
order to provide context for understanding the stated conclusions of the 
work and avoid misleading users of the report. 


” CAM 6-102. 
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Auditor objectivity issues. We also determined that DCAA's role with 
regard to making decisions to approve contractors for participation in the 
direct-bill program* presented an impaiiment to auditor objectivity — 
which includes being independent in fact and appearance when providing 
audit and attestation engagements.®" The objectivity impairment relates to 
DCAA’s audit role in authorizing contractors to participate in the direct- 
bill program, which places it in the position of making decisions that 
impact its nonaudit workload related to the review of contractor invoices 
prior to payment. For example, when contractors do not have direct billing 
privileges, DCAA acts as the authorized representative of the DOD 
contracting officer in reviewing contractor invoices prior to submission 
for payment. However, if DCAA auditors determine that a contractor has 
an adequate billing system, DCAA may authorize a contractor to 
participate in the direct-bill program, thereby eliminating workload related 
to review of the contractor’s invoices prior to payment. In addition, the 20 
billing system audits and follow-up audits we reviewed lacked sufficient 
testing to support reported opinions, or the opinions reported were 
inconsistent with the audit evidence, DCAA had approved all but 2 of the 
16 contractors involved in these audits for the direct bill program. 

At the end of our audit, DCAA had not rescinded any of the memorandums 
or reports on the results of the cost-related assignments we reviewed. 
Table 3 provides details on five selected case studies of flawed cost- 
related assignments that we reviewed dxuing the course of our work. 


* FAR 42.101, DFAFS 242.803(b)(1)(c), and CAM 6-1007. 

* G.ACWKMiiSG, §§ 3.03 through 3.18. 
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Table 3: Summary of Five Selected Cost-Related Assignments 


Case Region 

1 Eastern 


Type of 
assignment 

Paid voucher review 
(2004) 

Non-GAGAS 


Mid-Atlantic Paid voucher review 
(2004) 

Non-GAGAS 


Paid voucher 
review (2005) 
Non-GAGAS 


Case details 

• This contracts generatesSl.l billion in annual billings to the government. 

• The auditor assessed risk as low for this assignment without documenting the basis 
for the decision. The auditor then judgmentally selected 3 vouchers totaiing $86,000 
for testing out of a total of 222 vouchers submitted to the government for payment 
from March 2003 through February 2004. 

• The auditor tested the ftfst voucher selected and performed limited testing on the 
remaining 2 vouchers. The workpapers do not include any eviderice to show that the 
auditor p^ormed most of the audit steps required in the standard audit program. 

• Despite limited testing, on March 31, 2004, DCAA prepared a Memorandum for the 
Record, stating "continued reliance can be placed on the contractor's procedures for 
the preparation of interim vouchers. . and "the contractor has met the criteria for 
continued participation in the direct billing program." 

• In 2004, DCAA reviewed interim vouchers submitted by a contractor with $40 million 
in anrtuai sales. 

• The auditor chose a nonr^resentative selection of 3 vouchers totaling $621,000 
from a 3-moftth period. The auditor should have used a population covering a 1 2* 
month period because this assignment was designed to cover a 1-year period. 

• The auditor did not d(K;ument the sample selection methodology as required by 
OCAA's CAM. Although testing of 3 vouchers is not sufficient to support a 
conclusion on the effectiveness of the contractor's controls over preparation of 
interim vouchers, the auditor removed one of the 3 vouchers from testing and did not 
document a reason. 

• The auditor did not identify any errors in testing the two remaining vouchers. 

< On August 31. 2CN)4, DCAA reponed "continued reliance can be placed on the 
contractor's procedures for the preparation of interim vouchers" and “the contractor 
had met the criteria for continued participation in the direct billing program." 

~ This OOD contractor with over $1 ^iliii^in annual billings to the government was 
one of several contractors that performed work to suppon the FBI's Trilogy 
investigative systems upgrade project. 

• The auditor tested less than 20 vouchers of 5,530 vouchers issued in a 1 2-month 
period. 

• On April 14. 2005. DCAA issued a Memorandum for the Record, staling "continued 
reliance can be placed on the contractor’s procedures for the preparation of interim 
vouchers" and "the corMractor has met the criteria for continued panicipalion in the 
direa-bill program. 

• One year later, a GAO audit report revealed that during the time of this DCAA 
assignment, the contractor had over billed the FBI by over $400.0(X) in labor and 
improper first-class travel costs. 
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Case Region 

Type of 
assignment 

Case details 

4 Central 

Overpayment 
assignment (2005) 
Non-GAGAS 

• This DCAA assignment covered one of the five largest DOD contractors. 

• The auditor tested 4 transactions from a listing of potential underpayments and 
overpayments prepared by the contractor. The auditor did not independently verify 
the accuracy or completeness of the contractor's listing. 


The audrt program requ^ed the auditor to determine whether the contractor monitors 
the biilings submitted by top 3 to 5 subcontractors. However, the auditix 
performed this |M'Ocedi«e for only 1 subcontractor based on "auditor Judgment” and 
did not document the basis for this Judgment in the audit documentation. 

The auditor also relied on the unverified contractor-provided listing to identify 
refunds to the government. The auditor then 'Judgmentally selected" 2 refunds for 
testing from the contractor's listing. 


Western 


incurred cost 
audit (2004) 
GAGAS 


The auditors' conclusions that the contractor’s controls are sufficient to detect and 
correct billing errors and overpayments were not supported by sufficient testing or 
other independent evidence. 

This audit covered a $516 million incurred cost claim submitted by a contactor 
perfbrmirtg reconstruction work in Iraq. 

The auditors reponed about $6 million in questioned costs and about $83 million in 
unsupponed costs based on assist audits (ponions of the audit performed by other 
FAOs) that had not been received by the report issue date. 


Although the auditors charged 2,292 hours to this assignment, GAO determined that 
(he auditors did not perform sufficient woric to support the audit opinion. For 
example, the auditors traced claimed pool and base costs to the contractor’s 
accountir^ books and records using a threshold of $5 million for cost-type contracts 
and $2 nvilion fcH- lime and materials contracts, but did not perform detailed testing 
of support for transactions. Tracing amounts to the general ledger is not sufficient 
work to support an examination-level opinion and the auditors did not document the 
basis for the Judgment used to determine the multi million dollar thresholds. 


• Further, the auditors retied on testing performed in a related accounting system 
audit, which DCAA rescinded on December 2. 2008, in response to GAO concerns. 


« As a result, the auditor's risk assessment used to plan the incurred cost audit is no 
longer supported. 


S«yc« GAO o( OCAA owM 4ocvn>«nl»l»n auaior inierv>*«vs 


We did not attempt to re-perform these assignments to find out whether 
actual overpayments or billing errors existed. For additional details on the 
cost-related assignments we reviewed, see a^ipendix II. 


Poor Management 
Environment and Quality 
Assurance Structure at 
DCAA Impacted Audit 
Quality 


We found that a management environment and agency culture that 
focused on facilitating the award of contracts and an ineffective audit 
quality assurance structure are at the root of the agencywide audit failures 
we identiffed. DCAA’s mission and management goals focus on producing 
a large quanti^ of audite to support procurement and contract 
administration rather than assuring proper contract costs that help save 
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taxpayer doUars. In addition, an ineffective audit quality control system 
and a “clean" peer review opinion compounded the problem, hindering 
DCAA management from identifying and correcting agencywide audit 
quality problems. 

DCAA’s Mission Statement and DCAA’s current nussion statement does not address protecting the public 
Strategic Plan Do Not Focus on interest in the manner in which it carries out audits to help assure that 
the Public Interest contractors charge fair and reasonable prices that comply with applicable 

laws and regulations, cost accounting standards, and contract terms. 
Instead, DCAA’s mission statement calls for it to perform all necessary 
contract audits for DOD and provide accounting and fmancial advisory 
services regarding contracts and subcontracts to all DOD components 
responsible for procurement and contract administration. Similarly, 
DCAA’s 2006 strategic plan focused on various processes and outputs. 
DCAA’s strategic plan contains the following five strategic goals with 
targeted completion dales from 2006 through 2008: 

1. fostering a quality work-Ufe environment that promotes trust, 
teamwork, mutual respect, superior job performance and high morale; 

2. assuring customer si^faction by providing timely and responsible 
audits and financial services that meet or exceed customer 
requirements and expectations; 

3. attaining the highest level of professional competence through 
continuous improvement in the management and performance of 
audits and services; 

4. providing best value audit and financial services through continuous 
evaluation and improvement of audit and administrative processes; 
and 

5. providing an integrated information technology structure that 
promotes effectiveness and efficiency in providing services for internal 
and external customers. 

DCAA objectives under each strategic goal focus on process 
improvements and do not contain a clear plan for achieving the respective 
goal or adequate quantitative and qualitative measures for determining 
success, for example: 

• One DCAA quality of work-life objective is to assess whether the 
participative work team concept is the best model for facilitating 
continuous process improvement. The underlying activities include 
internal meetings and brainstorming sessions, literature reviews, and 
developing recommendations for executive committee review. None of 
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the activities included refer to identifying best practices or working 
with outside experts. 

• Another objective is to hold or lower attrition in high turnover areas. 
DCAA activities in this area include analyzing causes of attrition, and 
conducting surveys of new hires and departing employees. None of the 
related activities include surveys of like org^zations, consideration of 
best practices, or identifying and addressing causes of high attrition. 
Moreover, in response to our requests for attrition data, DCAA 
provided high-level summaries without any analysis. 

• DCAA’s strategic goal for customer satisfaction, included the objective 
of increasing by 20 percent annually the number of incurred cost audit 
reports issued with contractor cumulative allowable cost worksheets, 
completing 100 percent of identified incurred cost audits necessary to 
accomplish Defense Contract Management Agency (DCMA) 
performance goals for contract close-out and canceling funds.®* 

DCAA’s strategic plan contains no explanation of the Importance of 
these objectives or how they link to DCAA's mission. 

• A key goal related to best value audit services is for DCAA to manage 
its cost per direct audit hour at a level sufficient to maintain DCAA's 
competitive advantage over the comparable national public firm 
composite rate. One of the ways DCAA has achieved a low cost per 
audit hour is to maintain a pay structure that caps journey-level 
auditors at the GS-12 level. In addition, our work identified numerous 
instances where entiy-levol auditors with little or no experience often 
perform audit assi^iments by themselves. However, lower grade levels 
and limited experience can place auditors at a disadvantage when 
dealing with contractor officials. 

The Government Performance and Results Act of 1993 (GPRA)® directed 
federal agencies to shift their focus from traditional concerns of staffing 
and activity levels to a broad focus on outcomes or results by (1) defining 
a clear mission and desired outcomes instead of ou^uts, (2) measuring 
performance to gauge progress, and (3) using performance information as 
a basis for decision making. TTie act required agencies to meet with 
Congress and key stakeholders to clearly define their mission and develop 


®' Canceling funds refers to the point in time at which the availability of a fixed-year 
appropriation cancels and is no longer available for recording, adjusting, and liquidating 
obligatiorvs properly chargeable to the appropriation. (31 U.S.C. §§ 1552(a) and 1553(b)). 

“ Pub. L. No. 103-62, 107 Stat. 285 (Aug, 3, 1993). 
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long-term strategic goals as well as annual goals that were linked to them. 
Although these legislated requirements were directed at federal agencies, 
including DOD, DCAA’s mission statement and strategic plan were not 
revised to conform to GPRA requirements. 

Perfomicince Metrics Were GPRA also requires that once federal agencies establish their strategic 

Designed To Measure Output goals they are to develop results-oiiented measures for assessing 

performance in meeting those goals and publicly report on how well they 
are doing. However, most of DCAA’s performance metrics continued to 
focus on ouqiiut. Several DCAA managers noted that fear of outsourcing 
the contract audit function led DCAA to emphasize performance metrics 
that demonstrated high productivity and low cost. In fiscal year 2008, 
DCAA reported some results-oriented performance measures, such as 
return on investment and net savings related to questioned cost. However, 
most of DCAA’s metrics focused on production and audit cost, including 
cost per direct audit hour, 30-day cycle time on forward pricing audits, and 
dollars audited per hour. In addition, DCAA’s focus on completing over 
30,000 assignments annually with about 3,600 auditors continued to 
emphasize production of audits instead of performing quality audits that 
assured taxpayers that the government was paying fair and reasonable 
prices for contracted goods and services. 

DCAA’s Audit Quality DCAA’s audit quality assurance program was not properly implemented, 

Assurance Program Was resulting in an ineffective quality control process that accepted audits with 

Ineffective significant deficiencies and noncompliance with GAGAS and DCAA policy. 

Moreover, even when DCAA’s quality assurance documentation showed 
evidence of serious deficiencies within individual offices, those offices 
were given satisfactoiy ratings. GAGAS require that each audit 
organization performing audits and attestation engagements in accordance 
with GAGAS should have a system of quality control that is designed to 
provide the audit organization with reasonable assurance that the 
organization and its personnel comply with professional standards and 
applicable legal and regulatory requirements, and have an external peer 
review at least once every 3 years.“ 

Our analysis of DCAA audit quality review documentation for 14 of 48 
offices covered in audit quality reviews during fiscal years 2004 through 
2006 — the period covered in the last DOD OIG peer review — found that 
although DCAA gave satisfactory ratings to 13 of the 14 FAOs, DCAA 


“G.^O-07-731G, §§3.5(^3.52. 
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reviewers reported that 10 of these offices had 2 or more instances of 
serious GAGAS noncompliance, including inadequate planning, lack of 
proper supervision, and insufficient support for reported conclusions and 
opinions. However, DCAA gave only 1 of the 14 FAOs reviewed an 
unsatisfactory rating. The failed FAO had 5 of 9 assignments reviewed with 
at least two significant instances of noncompliance with GAGAS or DCAA 
policy. Further, although DCAA headquarters performed a follow-up 
review to confirm thsd problems identified at the failed office were 
corrected, DCAA headquarters officials told us they did not perform 
follow-up reviews to assure that the problems identified at other offices 
were corrected. 

In response to a DOD IG finding that DCAA quality assurance reviews did 
not cover a sufficient number of internal control system audits, DCAA 
increased the number of audits covered to date in its fiscal year 2007 and 
2008 quality assurance reviews. However, DCAA continued to 
inappropriately conclude that audits “demonstrated professional 
judgment," allowing reviewers to disregard serious deficiencies with 
GAGAS in concluding on overall audit quality.®" DCAA failed only I of the 
40 FAOs as a result of its fiscal year 2007 and 2008 audit quality reviews. 
Our analysis of DCAA’s audit quality results showed that 19 of the 40 
FAO’s had two or more audits with at least 2 Instances of significant 
noncompUance with GAGAS or DCAA policy. However, 18 of these FAOs 
received a satisfactory rating. DCAA headquarters has not yet followed up 
with offices that had deficient audits. 

The examples in table 4 show the disparity between DCAA quality 
assurance reports of a “satisfactory level of compliance" and actual results 
documented by quality assurance reviewers. The examples below also 
illustrate the long-term nature of this problem. 


In using prof€SsionaI judgment, GAGAS (GAO-07-7:i IG, §§ 3.32 and 3.35) require auditors 
to act diligently in accordance with applic^le professional standards »\d ethical principles 
in all aspects of carrying out their professional re^oixsibilities. 
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Table 4: Summary of Selected DCAA Audit Quality Review Results 

Region 

Number and type 
of audits 

DCAA audit quality review conclusions and findings 

Eastern 

5 incurred cost 
audits 

On October 28. 2008, DCAA reported a satisfactory level of compliance for the FAO reviewed. 
Supporting documentation showed that reviewers found that 2 of 5 audits reviewed had at least 

2 instances of significant nonconpliance with GAGAS and DCAA policy, including insufficient 
supervisory involvemer^ and inadequate workpaper documentation to support signiftcant auditor 
Judgments and conclusions. 

North-eastern 

8 forward pricing 
audits 

On September 27, 2007, DCAA repwled satisfactory compliance by the FAO reviewed. 
Supporting documentation showed that reviewers found that 4 of 8 audits had at least 2 
significant instances of noncompliance vi/ith GAGAS or DCAA policy and 2 of the 4 audits had 3 
instances of noncompltance. inctudir^ inadequate planning and supen/ision and failure to 
exercise reasonable professional judgment. 

Central 

8 other (various) 
assignments 

On April 4. 2006, reviewers gave the FAO reviewed a satisfactory rating. However, supporting 
documentation showed that audit quality reviewers found that 2 of 8 assignments had at least 
two significant deficiencies related to rtoncompliance with GAGAS and DCAA policy, including 
irradequate planning on 3 assignments and inadequate supervision on 2 assignments. 

Reviewers also determined that the auditor on one other assignment had not met the annual 
requirement for contirtuirtg professional education. 

Western 

5 incurred cost 
audits 

On April 26, 2005, reviewers gave the FAO a satisfactory rating. Although the audit quality 
review documentation identified only 1 audit that had at least 2 instances of significant 
deficiencies, the documentation noted limited testing and stated that statistical sampling was not 
used, as required. The reviewers also found that audit working papers did not support the 
conclusions in the audit report. The reviewers noted that insufficient supervisory involvement 
was responsible in part for the deficiencies found in the audit. 

Mid-Atlantic 

6 incurred cost 
audits 

On September 29, 2005. reviewers reported a satisfactory level of compliance for this FAO. 
However, supporting documentation showed that 4 of the 6 audits had at least 2 significant 
deficiencies related to noncompliance with GAGAS and DCAA policy. For example, audit quality 
reviewers noted that the risk assessment for one assignment inappropriately stated the 
contractor's accounting system was adequate. In addition, reviewers stated (hat conclusions and 
opinions in reports for three audits were not based on sufficient evidence. Reviewers also noted 
that three audits had significani deficiencies, including insufficient testing, inadequate 
procedures to identify illegal acts and noncompliance with laws and regulations, and reporting 
problems. Reviewers also found inaccuracies in reporting on three audits and stated that reports 
on 2 of (he audits should not have been issued and a reported qualification in the report for the 
third audit was worded incorrecUy and implied that work had been performed when the related 
assist audits had not been completed. 

Eastern 

6 internal control 
audits 

On June 8, 2004, DCAA reported satisfactory compliance by the FAO reviewed. However, 
supporting documentation showed that 2 of 6 audits reviewed had at least 2 instances of 
significani noncompliance with GAGAS and DCAA policy, including inadequate supervision, 
missing workpapers on the contractor's control environment, and insufficient and incomplete 
workpaper evidence to support corrclusions in the audit reports. 

North-eastern 

8 forward pricing 
audits 

On June 26, 2003, DCAA reviewers reported satisfactory level of compliance by the FAO 
reviewed. Audit quality review documentation showed that reviewers found that 6 of the 8 audits 
had at least 2 instances of significant GAGAS or DCAA policy noncompliance. For example, 2 
audits were not adequately planned and 4 audits had inadequate supervisory involvement. In 
addition, supervisory review was performed 10 days after the report was issued on one audit, 
and audit work did not support the reported opinion on a second audit. 


Source: GAO aoelysis ol DCAA documeniaUon. 
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In March 2009, DCAA officials advised us that going forward, DCAA plans 
to report aU audit quaUty review findings along with recommendations for 
corrective action and follow-up to assure that FAOs have taken 
appropriate corrective action. 

DOD IG Peer Review Opinion The DOD IG reported an adequate (“clean") opinion on DCAA’s most 
on DCAA’s Audit Quality recent peer review results although the reported evidence indicated that 

Control System Is Inconsistent numerous audits had serious deficiencies in audit quality.® In conducting 
with the Underlying DOD’s audit oversight review of DCAA audits for fiscal year 2006, DOD IG 

Deficiencies Reported audit oversight reviewers considered the same results of DCAA’s internal 

audit quality assurance reviews that we analyzed and reviewed numerous 
additional audits, which also identified significant GAGAS noncompliance 
as evidenced by DOD IG peer review findings and recommendations. 
Although the DOD IG report contained evidence of significant, systemic 
noncompUance with professional standards throughout DCAA audits that 
OIG staff reviewed, and the IG report included numerous findings and 
recommendations related to those issues, the DOD IG gave DCAA a 
“clean" peer review opinion,® concluding that: 

“In our opinion, the DCAA system of quality control for audits and 
attestation engagements perfonned during the FY ended September 30, 

2006, was designed in accordance with quality standards established by 
Government Auditing Standards (GAS). Further, the internal quality 
control system was operating effectively to provide reasonable 
assurance (hat DCAA personnel were following established policies, 
procedures, and applicable auditing standards. Accordingly, we have 
determined that the DCAA system of quality control used on audits and 
attestation engagements for the review period ended September SO, 

2006, is adequate.* 

The overall report conclusion in the DOD IG report is not consistent with 
the detailed observations in the report, which indicate numerous 
significant deficiencies in DCAA’s system of quality control. Furthermore, 
based on DCAA’s actions to rescind dozens of audit reports®’ related to our 


® All 10 categories of recommendations in the DOD IG’s report related to GAGAS 
compliance problems. 

® DOD Inspector General, Oversight Rennew: Review of the Defense Contract Avdii 
Agency Qmlity Control System, Report No. D-2007-6-006 (Arlington, VA: May 1, 2007). 

Of the 80 rescinded audit reports, 39 reports were issued in fiscal year 2006 — the period 
covered in the EKDD IG peer review report on DCAA. 
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prior investigation and this audit and our analysis of DCAA’s internal audit 
quality review procedures and documentation — all of which relate to the 
period covered by the DOD IG peer review — we concluded that DCAA’s 
quality control system for the period covered by the last DOD IG peer 
review was not effectively designed and implemented to provide 
assurance that DCAA and its personnel comply with professional 
standards. The DCAA audits performed during fiscal years 2007 and 2008 
were performed under the same policy guidance and production-related 
performance metrics as the earlier audits and had the same types of 
GAGAS noncompliance, as indicated by DCAA’s internal audit quality 
review fmdings for audit reports issued in hscal years 2007 and 2008. 

DCAA Lacks a Risk-Based the absence of a risk-based audit planning approach, DCAA has 

Audit Planning Approach historically performed 30,000 to 40,000 audits annually to support 

contracting community decisions on contract awards, administration, and 
close-out using 3,000 to 4,000 auditors — an average of about 10 audit 
reports per year for each auditor. The large number of assignments has 
contributed to the production-oriented environment and widespread 
problems we have identified with audit quality. The failure to perform 
quality audits leaves government contracting officers and disbursing 
officers with inadequate information, ultimately putting taxpayers at risk 
of improper contract payments and fraud, waste, abuse, and 
mismanagement. GA&sStandards for Internal Control in the Federal 
Government*^ require federal agency managers to identify and assess 
relevant risks the ^ency faces from external and internal sources 
associated with achieving agency objectives, such as those defined in 
strategic and annual performance plans developed under the GPRA. To do 
this, management needs to consider aU significant interactions between 
the entity and other parties as well as internal factors at the agency and 
activity levels. The specific risk analysis methodology used can vary by 
agency because of differences in agency missions and the difficulty in 
qualitatively and quantitatively assigning risk levels. For example, DCAA 
would need to consider requirements in law and federal regulation to audit 
contractor cost, price, schedule, systems, and compliance with laws, 
regulations, cost accounting standards, and contract terms. DCAA also 
would need to consider risks associated with contractor activity and the 
materiality of contractor costs. Once risks have been identified, sound 
management controls require that they should be analyzed for their 


“ GAO, SiaTMtartfa for Jiaemal Control in the Federal Government, GAO/AlMD-O0-2i,3. 1 
(Washington, D.C.; November 1999). 
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possible effect, and management should decide how to manage the risk 
and what actions should be taken. 

A risk'based audit approach would help identiiy and prioritize which 
audits are the most important or have the highest return on investment 
and determine what constitutes appropriate testing for various audit and 
nonaudit services. Basing future audit plans on historical DCAA audit hour 
data is problematic because DCAA has not yet determined the time and 
effort that would be needed to perform quality audits. For example, 
historical audit hour data do not accurately reflect either the time needed 
to complete a quality audit or the hours actually worked on various audits 
because many auditors performed limited procedures or they performed 
audit procedures on their own time to meet budgeted audit hour metrics. 
In addition, some audits may not be necessary. For example, we 
concluded that 3 of the 37 internal control audits that we reviewed were 
not necessary. For one of the three audits, DCAA could have relied on the 
audit of a grantee that was performed under the Single Audit Act.® DCAA 
agreed with our conclusion. Two other unnecessary audits involved 
estimating systems of contractors that only have one contract with the 
government Because contract proposals, which would be tested as part of 
the estimating system audit for these contractors, are separately audited 
when they are submitted, we questioned the need for separate estimating 
system audits for these contractors. DCAA officials told us they would 
reconsider the need for separate estimating system audits in such cases. 

Developing a risk-based audit approach that considers the risk of 
improper contract payments and available resources would also be a first 
step in determining the level of audit resources and traiiung needed to 
accomplish effective contract audits. In addition, determining appropriate 
roles and re^onsibilities for nonaudit assignments would liirther clarify 
DCAA audit resource needs as well as needed job skills and funding for 
buying commands and DCMA. 

The most pervasive audit deficiency we identified was insufficient testing 
to support DCAA’s reported conclusions and opinions. Limited audit 
testing was directly related to DCAA’s goal of performing 30,000 or more 


® Codified, as amended, at 31 U.S.C. ch. 75. The Single Audit Act requires that a state, local 
government or non-profit organization that expends more than $500,000 in a fiscal year 
undergo a single au^t, which includes an audit ot the entity’s financial statements and 
Schedule of Elxpenditures of Federal Awards, as well as testing of and reporting on certain 
internal controls. 
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audit assignments annually. Achieving a goal of performing quality audits 
wiD depend, in part, on ^propriate guidance on testing coupled with 
adequate training and supervision. Quality audits will also be dependent 
upon contracting community support of a risk-based audit approach and 
an appropriate delegation of nonaudit contract administration activities 
and audit responsibilities among DCMA, buying commands, and DCAA. As 
noted above, DCAA provides nearly all of its services to the contracting 
and finance communities as GAGAS audits. However, a risk-based audit 
approach may require these communities to re-evaluate whether all such 
services should be provided as audits and whether DCAA, as an 
independent audit organization would perform any nonaudit services. 

DCAA Lacks Effective Human DCAA’s deficiencies in audit quality are directly related to its human 

Capital Management capital management. Effective, efficient contract audits and oversight are 

dependent on a workforce that has the required skills to meet 
organizational goals and perform quality audits that serve the public 
interest, especially the taxpayer. Both GAGAS and GAO’s Internal Control 
Standards^ require that personnel possess and maintain a level of 
competence that allows them to accomplish their assigned duties. GAGAS 
specifically requires that the staff assigned to conduct audit or attestation 
engagements under GAGAS must collectively possess the technical 
knowledge, skills, and experience necessary to be competent for the type 
of work being performed before beginning that assignment.^’ GAGAS also 
requires attestation engagements to be properly supervised.’* Accordingly, 
agency management has a responsibility to identify appropriate 
knowledge and skills needed for various jobs and provide needed training, 
as well as candid and constructive counseling, and performance 
appraisals. DCAA’s human capital management practices of hiring auditors 
at the entry-level and assigning them to complex audits with little 
classroom training or on-the-job experience and minimal supervision have 
contributed to the audit problems we identified. 

Inadequate training and supervision. DCAA headquarters officials 
acknowledged that the agency could improve developmental training and 
that it does not have continuing training for DCAA auditors throughout 
their career, referred to by DCAA as life-cycle training. Given the 


GAf>07-7>51G §§ 3.40 throu^ 3.49, and GAO/.\IMD-0()-2I.3. 1 . 
” C,Aa ()7-73IG, § 3.43. 

GAiU)S-mCj, § 60.04a. and GA()-«)7-731G, § 6.04a. 
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complexity of contract audits and identified DCAA audit quality problems, 
timely and effective training and appropriate supervision are critical to 
achieving effective audits. Auditors also should understand the 
professional standards they are required to follow. 

In addition, we found that on-the-job-training and supervision, which are 
key components of developmental training, were not consistently provided 
to new auditors. On-the-job training for new auditors varied by supervisor 
and by DCAA field office. For example, we previously reported” that one 
of the offices in our hotline investigation had addressed this training need 
by assigning one supervisor to oversee trainee auditors and assigning 
trainee auditors to senior auditors who provided them on-the-job training 
during a particular audit. However, we identified 13 CAS compliance 
audits at this same office to which trainee auditors were assigned with 
little or no training or supervision. In addition, documentation for one of 
the team performance awards that we recently obtained from this office 
contained evidence that some trainee auditors were immediately given an 
audit assigiunent to carry out on their own. The performance award 
documentation stated as an achievement that “new hires were purposely 
assigned their own assignments as early as deemed appropriate in order to 
instill in them early the concept that they are responsible for the planning 
and conduct of their assigned audits. The supervisory and senior 
auditor. . .made a conscious decision to do tl^ to avoid dependency issues 
with the new auditors.” 

Our discussions with auditors in DCAA's 5 regions provide anecdotal 
examples of the training problems we found. For example, one auditor 
told us that entry level training is a “one-size-fits-all” approach that does 
not provide the right training at the right time, while four auditors told us 
they were not given enough time to develop their skills. One consistent 
comment from auditors was that on-the-job training was key to auditor 
effectiveness, but DCAA provided little or no opportunity for new auditors 
to obtain this develqf>mental experience. Several auditors told us that 
trainees in their offices are given assigmnents to do on their own and that 
while trainees may work with a senior level auditor, sometimes these 
senior auditors do not take a leadership role that would provide a learning 
experience for trainees. In addition, several auditors described DCAA’s 
internal training courses as “good," but noted that the courses covered 
high-level conceptual and technical information and did not provide the 


” (J.AO-OS-857. 
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detailed knowledge on how to apply this information when performing a 
particular contractor audit. Some FAO managers share this concern. 

Supervisors responsible for deflcient audits identified in GAO’s 
prior investigation were promoted. At the September 2008 hearing, 
Committee Members expressed concerns about DCAA promotions of 
supervisors who were responsible for improperly dropped audit findings, 
unsubstantiated changes in audit opinions, and abusive management 
actions gainst whistleblowers at locations covered in our investigation. 
Best practices of leading organizations making organizational and cultural 
changes include top leadership who set the direction, pace, and tone and 
provides a clear, consistent rationale that unites staff together behind a 
single mission. Agency management plays a key role by setting and 
maintaining the organization's ethical tone, providing guidance for proper 
behavior, removing temptations for unethical behavior, and providing 
discipline, when appropriate. Our review of GAO hotline allegations 
received since our investigation showed that meeting metrics related to 
producing reports within budgeted hours and planned time frames 
resulted in performance awards for auditors who performed deficient 
audits with little or no testing and lower performance ratings and 
personnel actions that resulted in downgrades and termination of auditors 
who did not meet these metrics. Further, our analysis of performance 
appraisals and performance award information for auditors and 
supervisors at the location in our investigation where supervisors had 
been promoted^* showed that the supervisory auditors responsible for 
deficient audits at this location were rewarded with high performance 
appraisals, cash awards, and promotions. 

We obtained performance evaluations and performance award 
documentation for auditors and supervisors involved with 12 audits that 
had serious deficiencies at the first location we investigated in our prior 
work. The DCAA Director told us that there are legal issues associated 
with holding employees, such as the supervisory auditors, accountable for 
actions that were identifi^ after-the-fact. However, the two supervisory 
auditors responsible for the deficient audits were ^proved for promotion 
even though Western Region managers who made promotion decisions 
were aware of the GAGAS compliance problems. DCAA’s Western Region 
management had received the DOD IG’s January 24, 2007, memorandum of 
investigation covering 10 audits performed at this location that did not 
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meet GAGAS. Further, during the summer of 2(H)7, Region management 
was responding to issues identified in our hotline investigation, which 
mirrored the IG’s concerns and raised concerns about GAGAS compli^ice 
with four additional audits. Despite these findings, we found no evidence 
that supervisors and auditors who did not follow GAGAS and DCAA policy 
were disciplined, counseled, or required to take additional training. 
Instead, our review of performance appraisal and awards documentation 
showed that the supervisors and auditors responsible for the deficient 
audits received performance appraisals ranging from “exceeds fully 
successful" to “outstanding" along with numerous cash awards. One of the 
two supervisors responsible for inappropriate decisions to drop audit 
findings and change c^inions without supporting evidence was promoted 
on October 14, 2007, and the second supervisor was selected for 
promotion on July 25, 2008 — 3 days after our investigative report was 
i^ued. DCAA placed a hold on the second supervisor’s promotion pending 
further investigation. In addition, a senior auditor who dropped audit 
findings without support at the direction of the second supervisor was 
promoted to a supervisory auditor position on January 6, 2008. In contrast, 
the performance appraisal of the senior auditor witness from that office 
who testified at the Committee s September 2008 hearing was lowered two 
levels from “outstanding" to “fully successful” following the submission of 
her hotline complaint, and she received no cash awards. DCAA has 
rescinded all 12 audit reports and re-performed the 12 audits associated 
with our investigation at this field location. 

Allegations about abusive management actions have continued. We 
found that DCAA’s current organization is highly decentralized, fostering a 
culture of region autonomy. Within this culture, DCAA’s Western Region 
appears to have continuing problems with unresolved allegations of 
abusive management actions. For example, 21 of the 34 DCAA hotline 
allegations we received since our July 2008 report,” include examples of 
abusive management actions, such as auditors being penalized for 
attempting to perform what they believe was sufficient testing to support 
audit opinions and auditors not completing work within established 
timeframes. Nine of these 21 allegations relate to DCAA’s Western 
Region — the subject region in our prior hotline investigations. Seven of the 
9 allegations relate to current problems in the Western Region. Our review 


” We spoke to the auditors and reviewed documentation they provided. To the extent that 
the auditors also submitted complaints to DCAA’s anonymous Web site, we reviewed 
DCAA's handling of their complaints. 
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of DCAA anonymous Web site contacts as of the end of May 2007 showed 
that over 40 percent (65 of 152) of the DCAA contacts also relate to the 
Western Region, including several that pertain to abusive management 
actions.™ Although DCAA headquarters officials have followed up on some 
of the complaints about management abuse that they received, decisions 
on disciplinary or corrective action typically have been delegated to region 
management. DCAA headquarters officials explained that in several cases, 
Western Region management has not agreed to take disciplinary or other 
available corrective actions. The officials told us that DCAA hotline staff 
have no recourse in these situations. 


DCAA Has Made 
Progress, but 
Correcting 
Fundamentzil 
Problems in Agency 
Culture That Have 
Impacted Audit 
Quality Will Require 
Sustained Leadership 


Although DCAA has taken several positive steps, much more needs to be 
done to address widespread audit quality problems. DCAA’s production- 
oriented culture is deeply imbedded and likely will take several years to 
change. Under the decentralized management environment, there has been 
little headquarters oversight of DCAA regions, as demonstrated by 
nationwide audit quality problems. Further, DCAA’s culture has focused 
on hiring and promoting from within the agency and most training has 
been conducted by agency staff. This has led to a very insular culture 
where there are limited perspectives on how to make effective 
organizational changes. In response to our July 2008 investigative report,” 
DOD’s former ComptroUer/CTO and Defense Business Board (DBB) 
conducted reviews™ of DCAA operations and made recommendations for 
corrective actions. The recommendations of the DBB are consistent with 
many of the recommendations discussed later in this report. DCAA has 
taken actions to revise performance metrics, change certain policy 
guidance, and obtain an independent organizational assessment (staff 
survey); however, DCAA has not yet addressed the fundamental 
weaknesses in its mission, strategic plan, audit approach, and human 
capital practices. Moreover, DCAA actions to date have focused on 


™ After we provided our report to DOD for comment, we received updated infonnation on 
DCAA anonymous Web site complaints. As of the end of July 2009, DCAA had established 
209 cases- Eight of those cases were immediately referred to the DOD IG for investigation. 
Of the 209 cases, 82 were for the Western Region. 

”GAO-OS-857. 

™ Based on audit quality problems identified in our July 2008 report, in August 2008, the 
DOD ComErtroller/CPO conducted a tiger team review in August 2008 and also asked the 
Secretary of Defense for support in conducting a study of DCAA. With the Secretary’s 
approval, the DOD Advisory Panel determined that the Defense Business Board would 
perform this Study- 
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process and have not addressed the agency’s decentralized organizational 
structure that has fostered a culture of DCAA region autonomy. On 
October 23, 2008, the DBB discussed its preliminary fmdings and 
recommendations at a public meeting, and on January 22, 2009, the DBB 
released its DCAA study report, which concluded that: 

• DCAA’s mission focused primarily on supporting the procurement 
community with no mention of protecting taxpayer interest. The 
current mission statement also provided for advisory services that 
raised serious questions about DCAA’s independence and objectivity 
under GAGAS. 

• DCAA’s strategic plan did not address essential elements required by 
GPRA, and it did not address emerging issues that could affect mission 
accomplishment or c<mtain a human capital strategic plan despite 
spending 80 percent of its budget on personnel. 

• None of DGAA’s 24 performance measures addressed audit quality, 
such as conformance to GAGAS, and only 8 could be tied to DCAA’s 
strategic plan. 

• DCAA’s decentralized organizational culture dilutes effectiveness of 
managerial oversight and affects GAGAS compliance and audit quality. 

• DCAA has not established a human capital strategic plan as a key tool 
to facilitate human capital management and workforce development in 
support of DCAA’s mission and implementation of its strategic plan. 

The following discussion summarizes the status of DCAA corrective 
actions on identiffed weaknesses, including actions on key DBB and DOD 
ComptroUer/CFX> recommendations. 


DCAA’s Mission Statement The DBB report, released in January 2009, pointed out that DCAA had five 
and Strategic Plan Have versions of a mission statement, noting that each version focused 
Not Yet Been Revised primarily on supporting the procurement community. The Board 

concluded that DCAA’s mission should be refocused to protect the 
taxpayer’s interests, writing; “The mission fostered the culture of 
supporting contracting officials, and the value system was one of quantity 
(number, cost, and timeliness of audits) over quality. . .which was further 
reinforced by the performance metrics that drove the organization.” In 
addition, the Board reported that instead of complying with GPRA 
strategic planning requirements for long-term goals and objectives for 
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major operations and functions, DCAA’s plan resembled a short-term 
process improvement checklist and did not address enterprise risk, 
external factors, or emerging issues that could affect mission 
accomplishment In addition, the Board noted that DCAA’s strategic plan 
did not include an adequate human capital strategy to facilitate workforce 
development, recruiting, retention, and succession planning. 

The DBB report recommended that the Secretary of Defense revise 
DCAA’s mission to focus on protecting the interest of taxpayers, with the 
taxpayer as the primary customer, and that DCAA establish a core value of 
performing high quality, independent, and objective contract audits that 
adhere to GAGAS and ensure that taxpayer dollars are spent on fair and 
reasonable contract prices. The DBB did not address any amendments that 
might need to be made to the FAR, DFARS, and DOD Directives and policy 
documents that reflect DCAA’s primary role as an advisor to government 
contracting officers and disbursing officers.” 

Leading organizations that have undergone cultural and organizational 
transformation have identified top leadership involvement in developing a 
mission statement and strategic plan as a best practice. These 
organizations consider top leadership commitment in setting the direction, 
pace, and tone for the transformation as essential to provide a clear, 
consistent rationale that unites agency components behind the mission to 
guide the transformation. In meetings with DCAA officials, we expressed 
our concern that the Secretary of Defense had not taken action to revise 
DCAA’s mission statement. On March 12, 2009, following a discussion on 
the preliminary results of our audit, the DCAA Director submitted a 
proposed reviaon to DCAA’s mission statement to the ComptroUer/CPO 
for review. The proposed revision inserted phrases that refer to “...serving 
the public interest” and “...ensure taxpayer dollars are spent on fair and 
reasonable contract prices." Although the revised mission statement had 
not been approved by the Secretary of Defense as of the end of July 2009, 
these changes would be positive. 

DCAA Has Not Yet Developed a The DBB also recommended that DCAA develop a strategic plan that 
Strategic Plan To Provide a cascades from the revised mission statement and concurrently develop (1) 
Framework for Organizational annual performance operating plan and a balanced scorecard tied to 
and Cultural Reform strategic plan and (2) a human capital strategic plan. In addition, the 


The Secretary of Defense Has 
Not Yet Developed a DCAA 
Mission Statement That 
Focuses on Protecting the 
Public Interest 


” On most contracting matters with DCAA involvement, the cognizant agency contracting 
officer makes final decisions based on DCAA’s findings and recommendations. 
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DBB recommended th^ DCAA obtain an independent assessment of 
resource needs and engage an external professional organization to assist 
in a cultural transform^ion. 

DCAA officials told us they are having difficulty identifying an 
independent external professional organization to assist the agency in 
developing a strategic plan because DCAA audits most of the organizations 
that should be able to provide this type of assistance. In her February 27, 
2009, response to the DBB report, the DCAA Director stated that DCAA 
expects to con^letc action on this recommendation by September 2009. 
With regard to die recommendation to develop a balanced score card, the 
DCAA Director reported that based on agreements with prior DOD 
Comptroller/CFOs, DCAA plans to use a monthly status report of agency 
performance measures rather than developing a balanced score card. 
Together with the change in performance measures for fiscal year 2009, 
DCAA implemented the monthly performance report in October 2008. The 
DCAA Director stated that DCAA will refine the annual performance plan 
in accordance with development of a revised strategic plan. 

The DCAA Director also stated that DCAA initiated a process to 
reengineer its human capital strategic plan in November 2008. The 
Director stated that DCAA obtained example plans from other 
organizations and attended training on human capital plan preparation and 
maintenance. DCAA is also seeking assistance h'om extern^ organizations 
in reengineering its human capital plan. 


DCAA’s Director Took 
Immediate Action To 
Eliminate Production 
Metrics, but Concerns 
about Audit Quality 
Measiu*es Remain 


The Committee’s September 2008 DCAA oversight hearing raised concerns 
that DCAA’s performance metrics focused on producing reports rather 
than performing quality audits and that auditors who attempted to perform 
quality audits were penalized for not meeting production goals. The DCAA 
Director acknowledged problems with the agency’s metrics and stated that 
she had initiated a project to assess the agency’s use of performance 
measures that would be completed by September 30, 2008. Performance 
metrics provide the basis for measuring achievement of agency mission 
and strategic goals. Accordingly, performance measures should be 
consistent with agency strategic goals. Although DCAA’s mission 
statement and strategic plan have not yet been revised to provide new 
goals, the DCAA Director took action in September 2008 to eliminate 
production-oriented performance measures. On September 30, 2008, the 
Director Issued a policy memorandum that eliminated 18 performance 
measures, identified 9 performance measures with goals for use in fiscal 
year 2009, and clarified the use and level of reporting on the revised 
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measures. Some of the new performance metrics focus on outcomes, 
while others continue to focus on producing low cost audits in fixed time 
frames. 

New Performance Metrics 'Th® DOD Comptroller/CFO required DCAA to develop standard metrics to 

Intended To Focus on measure and re-enforce compliance with GAGAS and CAM across DCAA 

Achieving Quality Audits by February 28, 2009. Tt^e DCAA Director reported that the new metrics 

established on September 2008, met this requirement. DCAA identified 
the following six new performance metrics as focusing on the intended 
outcome-related goal of achieving quality audits that comply with 
GAGAS. “ 

1. Obtaining an unqualified DOD IG peer review opinion. 

2. DCAA’s internal qualify assurance program results show that 100 
percent of the audits reviewed reflected professional judgment. 

3. Checklist confirmation that issued reports did not include serious 
deficiencies. 

4. A goal that 45 percent of audit reports will have findings as an 
indication of the tangible value of the audit work performed. 

5. A goal that 16 percent of the audits will use quantitative methods to 
measure the extent to which advanced level audit techniques are used. 

6. A goal that auditors will meet 100 percent of their continuing 
professional education requirements on time. 

Only metrics number 1, 3, and 6 have a direct relationship to audit quality. 
Although metric number 2 could improve audit qualify if properly 
implemented, DCAA gave passing scores to deficient audits. Given the 
problems with DCAA’s ineffective quality assurance program and DOD IG 
peer review results, for these three metrics to achieve the intended audit 
quality goal, significant changes will be needed in policy guidance and 
training on audit standards, appropriate procedures, and audit 
documentation in order to comply with GAGAS. The fourth goal that 46 
percent of DCAA audit reports will have findings is approximately the 
same as the actual percentage of 41 percent of the reports in 2008. 

Because findings would support recommendations for corrective action, 
this metric could contribute to improvements in accountability over 
contractor cost and billings. Regardless of the goal, findings should be 
reported as appropriate based on the completion of qualify audits. F\u:ther, 
the use of quantitative methods of analysis in audit reports needs to be 


DCAA also established contracting officer sustention rates related to questioned cost and 
net savings as an informational goal to show return to the taxpayer. 
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supported by training on the appropriate methods for sampling and testing 
contract costs, controls, and compliance to help auditors perform 
sufficient testing to support audit conclusions and opinions. 

Performance Metrics That Although three of DCAA’s fiscal year 2009 metrics are important in that 

Continue To Measure Output they address rc^onsiveness to contracting officer requests for audits, if 
not properly managed, they could impact the effectiveness of DCAA’s new 
audit quality metrics. In the past, DCAA’s efforts to meet contracting 
officer requests for audits within specified time frames caused auditors to 
sacrifice audit quality. The following three performance metrics continue 
to address issuing reports within specified tim^ to support contract 
awards and closeouts. 

• A forward-pricing audit timeliness goal of 95 percent based on 
j^eement with requesters. 

• Incurred cost audit timeliness goals of 90 percent of corporate audits 
completed within 12 months, 90 percent of major contractor audits 
completed in 15 months, and 95 percent of non-major contractor audits 
completed in 24 months. 

• An efficiency goal of cost per direct audit hour of less than $1 13.46 to 
be monitored at the agency level only. 

It is critical that agreements with the contracting community on timeliness 
goals for forward-pricing and incurred cost audits allow performance of 
sufficient audit procedures to help contracting officers ensure that prices 
paid by the government are fair and reasonable, and that contract costs 
comply with 2 q>plicable laws, regulations, cost accounting standards, and 
contract terms. In addition, keeping cost per direct audit hour in line with 
past practices indicates that DCAA likely would continue to use trainee or 
junior auditors on assignments without senior auditor or supervisory 
auditor involvement. GAGAS requires that staff assigned to perform the 
audit or attestation engagement must collectively possess adequate 
professional competence for the tasks required.®' Moreover, DCAA has not 
agreed to develop a risk-based audit approach to address how it will 
perform required audits with available audit resources, reassess the need 
to perform 30,000 or more audits annually, and establish priorities for 
performing quality audits that meet GAGAS within available resources. 


*'GAtW)7-731G, §3.40. 
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On October 30, 2008, DCAA required regional audit managers to provide 
training on changes in performance metrics to all FAOs by December 31, 
2008, as part of the effort to get the word out that DCAA’s mission should 
be to protect taxpayer interest and that auditors should perform quality 
audits that meet GAGAS. The DCAA Director stressed to us that budgeted 
audit hours would be csqitured for planning purposes, but they were never 
intended and should not have been used to evaluate auditor performance. 
The DCAA Director also told us that DCAA auditor performance 
appraisals should not have considered exceeding budgeted audit hours as 
a performance failure. In addition, DCAA implemented an anonymous Web 
site for c 2 q)turing feedback on inappropriate use of the new performance 
measures and abusive management actions. 

Inconsistent Implementation During random telephone calls made to 17 auditors across 15 FAOs in the 
and Training on New Metrics DCAA regions, we found mixed results on FAO implementation of 

DCAA’s new performance metrics. DCAA’s Assistant Director of 
Operations told us she also had become aware of some problems with 
regional audit maiw^ers meeting the requirement to provide training to 
FAOs on implementation of the new DCAA performance metrics. The 
Operations Assistant Director told us that she planned to follow-up with 
all FAOs in this regard. In response to our telephone calls, for example: 

• Auditors at 13 of the FAOs told us that metrics related to meeting 
budget hours for completing audits have been relaxed. Although most 
of these auditors were not aware of audit completion dates in fiscal 
year 2009 program plans for their offices, two auditors told us that 
audit completion d^es had been pushed back to allow more time for 
performing individual audits. An auditor at a Northeast Region FAO 
told us the use of budget hours was flexible before the metrics 
changes, so there was no noticeable difference. An auditor at a 
Western Region FAO said that although budget hours are no longer a 
metric for individual auditor performance, there is still a lot of pressure 
on auditors to meet budgeted hours. 

• Auditors at 5of the 15 FAOs told us they had received the mandatory 
training on changes in performance metrics prior to December 31, 

2008. However, auditors at 4 FAOs told us they received the mandatory 
training after December 31, 2008, including two auditors at one Eastern 
Region FAO who told us they did not receive the required training until 
February 13, 2009. Auditors at the other 6 FAOs told us they received 
the metrics training, but they could not remember the dates of the 
training. 
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• Auditors at 5 FAOs told us they were permitted to charge from 1 to 2 
hours of administrative time per pay period for reading e-maiis on 
DCAA policy changes and new policy memorandums. Auditore at 2 
FAOs said they were not given an administrative code for this purpose. 
One of these auditors told us tliey read the policies on their own time. 
Auditors at the remaining 8 FAOs did not mention a time limit for 
reading DCAA policy memoranda. DCAA headquarters officials told us 
that auditors should be permitted to charge administrative codes for 
this purpose and that they are working to resolve this issue across 
DCAA 

The DCAA Director advised DCAA employees that the new performance 
metrics would be revisited after 6 months to determine if changes are 
needed. On February 1 1, 2009, DCAA revised its fiscal year 2009 job 
objectives/performance plans to reflect the new performance measures, 
and DCAA’s Deputy Assistant Director of Operations advised us that 
DCAA initiated an assessment of the new performance metrics in April 
2009. 


DCAA Has Centralized, but 
Has Not Yet Restructured 
Its Audit Quality 
Assurance Program 


DCAA has taken some actions to improve its quality assurance program. 
However, staffing difficulties and other issues have left the outcome of this 
important initiative uncertain. As previously discussed, GAGAS require 
that each audit organization performing audits and attestation 
engagements in accordance with GAGAS should have a system of quality 
control that is designed to provide the audit organization with reasonable 
assurance that the organization and its personnel comply with 
professional standards and applicable legal and regulatory requirements, 
and have an external peer review at least once every 3 years.® In addition, 
considering the large number of DCAA audit reports issued annually and 
the reliance the contracting and finance communities have placed on 
DCAA audit conclusions and opinions, an effective quality assurance 
program is key to protecting the public interest. Such a program would 
report review findings along with recommendations for any needed 
corrective actions; provide training and additional policy guidance, as 
appropriate; and perform follow-up reviews to assure that corrective 
actions were taken. When we briefed DCAA on our preliminary findings in 
March 2009, DCAA had not yet taken action to correct serious deficiencies 
in its quality assurance program, including problems with DCAA’s 
application of the professional judgment standard, whereby quality 


® (J AO07-731G, §§ 3.49-3.52. 
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assurance program officials gave satisfactory ratings when significant 
noncompliance with GAGAS had been identified by reviewers. 

In response to our previous report, on August 20, 2008, the DOD 
ComptroUer/CFO required that DCAA take certain actions to improve 
audit quality, which included a restructuring of DCAA’s quality assurance 
function. Accordingly, on August 22, 2008, DCAA established a new 
headquarters Directorate for Quality Assurance and Integrity, which 
centralized the quality assurance function at DCAA headquarters. The 
DOD ComptroUer/CFXI) directed that the new Quality Assurance 
Directorate be headed by a Senior Executive Service (SES) Deputy 
Director. Because DOD did not grant DCAA an additional SES position for 
this purpose, the DCAA Director assigned responsibility for leading 
DCAA’s quality assurance function to a level GS-15, Assistant Director for 
Integrity and Quality Assurance. Under DCAA’s management environment 
and culture, which continue to foster autonomous regions headed by SES- 
level directors, the grade level and experience of the GS-15 equivalent 
Assistant Director for Integrity and Quality Assurance pose a challenge 
when dealing with SES-level regional directors, deputy directors, and 
regional audit managers. For example, when presented with our findings 
and conclusions that various audits did not comply with GAGAS, DCAA 
headquarters policy and quality assurance managers allowed regions and 
FAO’s to decide whether to rescind the subject audit reports. In March 
2009, DCAA officials advised us that the GS'15, Assistant Director for 
Integrity and Quality Assurance position is an intended SES position and 
that two GS-15 Assistant Directors will perform as Chief of Integrity and 
Chief of Quality Assurance. 

In centraliring the quality assurance program, DCAA’s new quality 
assurance organization provides for five GS* 1 4 senior quality assurance 
auditors at DCAA headquarters and up to 27 GS-13 quality assurance 
auditors in the field assigned across the 5 DCAA regions. However, a 
headquarters requirement that all senior quality assurance staff relocate to 
DCAA headquarters at Fort Belvoir, Virginia, resulted in all but one of the 
five senior staff accepting other positions within DCAA because they did 
not wish to relocate. It took several months to recruit DCAA stafi" for the 
senior quality assurance positions at DCAA headquarters. On July 10, 2009, 
a DCAA headquarters official advised us that DCAA had selected staff to 
fill the two remaiiiing vacancies, and these staff would be reporting for 
duty in the next few weeks. 

In response to our concerns that DCAA’s quality assurance program has 
not resulted in audits that comply with GAGAS, DCAA officials advised us 
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that going forward, DCAA will no longer rate an FAO’s overall compliance 
with GAGAS and DOD policy. The officials told us that instead, DCAA 
headquarters plans to (1) report the detailed results of the audit quality 
reviews, (2) make recommendations to FAOs for any needed corrective 
actions, (3) conduct follow-up reviews for all FAOs with identified audit 
deficiencies to ensure that corrective actions are taken, and (4) provide 
training and policy guidance, as appropriate. If properly implemented, 
these procedures would help to assure an effective audit quality assurance 
program. 


DCAA Disagrees with the 
DBB Recommendation for 
a Risk-Based Audit 
Planning Process 


The DBB recommended that DCAA establish a risk-based planning 
process that expands DCAA self-initiated audits and increases the 
potential for identifying fraud, waste, and abuse, and higher rates of return 
to the taxpayer by April 2009. The DBB intended for DCAA to audit any 
and all contracts awarded by the department. On February 27, 2009, in 
responding to the DBB recommendation, the DCAA Director stated that 
(1) DCAA’s practice of auditing only certain contracts was due to 
regulation or statute and (2) absent the DCAA access-to-records clause in 
certain types of contracts, DCAA has no legal basis to obtain cost data 
from a contractor. The DCAA Director suggested that the DBB 
recommendation should be directed to the Under Secretary for 
Acquisition, Technology and Logistics, who oversees DCMA, and not 
DCAA. The DCAA Director told us that she believes that DCMA should 
address this recommendation because DCMA decides what audits DCAA 
should perform to support contracting decisions and DCMA would need to 
initiate action to change audit-related FAR requirements. 


Generally, DCAA, as the agent of the Secretary of Defense, has authority” 
to examine records of (1) a contractor performing any cost- 
reimbursement, incentive, Ume-and-materials, labor-hour, or price re- 
determinable contracts and subcontractors performing such contracts of 
the contractor and (2) to evaluate the accuracy, completeness, and 
currency of certified cost or pricing data required to be submitted 
pursuant to law, all records of the contractor or subcontractor related to 
the proposal, and discu^ions conducted on the proposal, pricing of the 
contract or subcontract or performance of the contract or subcontract. 
This authority is implemented by insertion of the Audit of Records clause 
in solicitations for negotiated contracts.®* In addition, the Director of 


” 10 U.S.C. § 2313and § 2300a. 
®* FAR §§ 52.214-26, 52.21^2. 
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DCAA may require by sut^oena the production of any records of a 
contractor that the Secretary of Defense is authorized to audit or examine. 
While DCAA does not have access to the records of all DOD contractors or 
statutory rights of access to contractor officials, we believe it has 
sufficient authority to undertake a risk-based audit approach consistent 
with its existing authority. Therefore, we believe the DBB 
recommendation for DCAA to develop a risk-based audit planning 
approach is appropriate. DOD acquisition officials we met with agree. 
Further, as previously discussed, a risk-based audit approach would 
provide a basis for determining audit resource requirements. 

DCAA has selected the Army Force Management Support Agency®® to 
perform its staffing study. However, DCAA is conducting a staffing study 
as a stand-alone effort rather than performing the study in concert with an 
effort to establish a risk-based planning process. To provide useful 
information for decision making, it is important that the staffing study and 
risk-based audit planning approach are conducted as integrated efforts. It 
is also important for the DOD contracting and finance communities to be 
involved in the staffing study analysis and planning process because, as 
discussed earlier, a risk-based audit approach may require these 
communities to re-evaulate whether all DCAA services should be provided 
as audits and whether DCAA, as an independent audit organization, should 
perform any nonaudit services. 

To address immediate staffing needs, DCAA requested funds for additional 
audit staff and training from the Defense Acquisition Workforce 
Development Fund,* including 300 positions for fiscal year 2009 and 
another 200 positions in 2010. DCAA received approval of this request in 
December 2008. In May 2(K)9, as part of DOD’s request for an additional 
9,000 positions for contract management and oversight, the DCAA request 
was increased from 500 to 700 new positions that are to be phased in from 


“ The Army Force Management Support Agency’s mission includes providing requirements 
studies and staffing analysis as well as determining whether organizations have the 
appropriate staff to cany out their mission. The Army Force Management Support Agency 
al^ provides services to DOD components. 

* Pub. L No. 110-181, §1705, 122 Slat. 3 (Jan. 28, 2008), the National Defense Authorization 
Act for Fiscal Year 2008, authorized the Secretary to establish the Department of Defense 
Acquisition Workforce Fund, in addition to other funds that may be available, for the 
recruitment, training, and retention of department acquisition personnel. The fund is 
managed by the Under Secretary of Defense for Acquisition, Technology, and Logistics. 
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fiscal year 2009 through 2011 ” As previously discussed, without 
developing a risk-based audit ^proach, it is difficult to determine the level 
of resources needed to perform effective, quality contract audits. 

However, federsd acquisition and contract audit resources have not kept 
pace with the growth on federal procurements. As shown in figure 2, 
although procurement obligations related to greater reliance on 
contractor-provided services and support of the Global War on Terrorism 
have more than doubled since fiscal year 2002, DCAA audit resources have 
remained about the same. In addition, contractor and subcontractor 
relationships have become more complex, increasing the complexity of 
contract audits. TTiese changes underscore the need for a risk-based audit 
plan and assessment of auditor resource and training needs. 


Figure 2: Comparison of DOD Contract Obligations and DCAA Workforce for Fiscal 
Years 2002 through 2008 
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According to a DOD Comptroller olTicial, DCAA will receive an additional 300 positions 
in fiscal year 2009 and additional 200 positions in each of fiscal years 2010 and 2011. 
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Although DCAA has undertaken certain initiatives to improve the 
effectiveness of audits of contractor billings and internal control systems, 
these efforts are not targeted for completion until September 2010 and 
September 2012, respectively, and they are not part of a comprehensive 
audit strategy or framework. Once decisions are made on changes in 
various audit procedures for these audits, related audit guidance and 
training would be needed to help ensure the new procedures are 
effectively implemented. 


DCAA Issued Revised 
Policy Guidance To 
Address Auditor 
Independence, Assure 
Management Involvement 
in Key Decisions, and 
Address Audit Quality 
Issues 


Our invesdgation and audit identified problems and concerns related to 
auditor independence, the need for management involvement in key 
decisions, and audit quality. In response to our work, the DBB and DOD 
ComptroDer/CFO made several recommendations for DCAA actions to 
address these concerns. Specific DCAA actions and our assessment 
include the following. 

Auditor independence. The DBB recommended that DCAA address 
advisory-type (nonaudit) services by (1) discontinuing participation on 
Integrated Product Teams and Source Selection Elvaluation Boards, both 
of which impair auditor independence in fact and ^pearance under 
GAGAS; (2) reevaluating the role and number of Financial Liaison 
Advisois (FLA) to ensure independence and objectivity in both fact and 
^pearance; and (3) working with the DOD acquisition leadership to 
explore alternatives for providing techiucal advice and support to the 
contract management community while adhering to the auditor 
independence standards in GAGAS. 


The DCAA Director responded that DCAA discontinued participation in 
Integrated Product Teams on August 4, 2008, and Source Selection 
Evaluation Boards on September 12, 2008, On November 23, 2008, DCAA 
realigned all FLAs to report directly to DCAA headquarters and completed 
em assessment of the number of advisors. DCAA is continuing to assess the 
functions performed by FLAs to assure their independence. The DCAA 
Director stated that if there is a significant change in the advisory 
functions, DCAA will initiate discussions with DOD acquisition leadership. 
We support efforts to reevaluate DCAA’s nonaudit advisory services given 
the problems identified in our investigation. Although our review of 
DCAA’s CAM guidcmce found that DCAA had established appropriate 
guidelines to avoid independence issues, we found that the auditors had 
not followed DCAA policy. According to the DCAA Director, the DBS’s 
primary concern is that DCAA participation in these advisory services 
created the appearance of a lack of independence. 
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Requirement for DCAA management involvement in key decisions. 
DCAA issued policy memorandums requiring that ( 1) FAO managers sign 
all audit reports issued by the FAO; (2) auditors elevate memorandums on 
disagreements with supervisors and FAO managers on draft audit opinions 
to the highest level necessary, including the DCAA Director, for resolution; 
and (3) auditors elevate problems in accessing contractor records to FAO 
managers, contracting officers, and regional offices for appropriate 
handling. 

DCAA action to require FAO managers to sign all audit reports issued by 
the FAO addresses concerns identified in our investigation that 
supervisors could in^propriately issue reports with adequate (“clean”) 
opinions without review by FAO manageis. Similarly, the policy to elevate 
disagreements on changes to audit opinions responds to findings in our 
investigation that supervisors ignored auditors' objections to dropped 
findings and changed opinions, and the auditors had no opportunity to 
elevate their disagreement beyond the supervisors. The access-to-records 
policy clarified actions required when auditors are denied access to 
records and required FAO managers to brief their staff on the revised 
guidance. The revised policy guidance emphasized that auditors (1) should 
follow procedures for addressing denial of access to records, which 
include notifying the FAO manager, contracting officer, and DCAA region; 
(2) take ^^propriate actions to effect a suspension or withholding of any 
unsupported costs billed to the government until the data are received and 
a determination is made regarding the allowability of the costs; and (3) 
question the unsupported costs in the audit report if the supporting 
documentation is not received prior to the completion of fieldwork. 
Although our work identified some access-to-records problems, in these 
cases, there was no evidence that DCAA supervisors elevated the issue to 
management or to procurement officials to initiate enforcement action, as 
set out in existing DCAA policy. 

Guidance to Improve audit quality. On August 6, 2008, the DCAA 
Director requested that each FAO hold a stand-down day (where staff 
were relieved of assigned duties to take mandatory training) to discuss 
audit quality and the requirement to comply with GAGAS requirements for 
competence, integrity, objectivity, and independence in performing 
contract audits. In addition, DCAA issued policy guidance on adequate 
audit documentation and testing, including the following guidance that 
applied to assignments we reviewed for this report: 

• “Workpaper Documentation of Judgmental Selections" — requires a 
description of the universe (population) from which items are selected 
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for testing, identification of items and attributes to be tested, and an 
eiqplanation to support that the judgmental selection will result in 
adequate audit coverage. 

Emphasizing the requirement that audit documentation include a 
description of the population used for sampling and identification of 
items and attributes to be tested is appropriate. However, the 
requirement for an explanation in the audit documentation that the 
judgmental selection will result in adequate audit coverage needs to be 
sufficiently justified. GAGAS and AICPA standards require that 
auditors document significant decisions affecting the audit objectives, 
scope and methodology, findings, conclusions, and recommendations 
resulting from profesaonal Judgment.® 

"Audit Guidance for Annual Testing of Contractor Eligibility for Direct 
Bill," which is intended to determine whether continued reliance can 
be placed on the contractor’s procedures for preparation of interim 
vouchers. This policy change clarified and consolidated audit steps 
related to the contractor’s compliance with contract provisions, added 
audit steps for reviewing vouchers under time-and-material and labor- 
hour contracts, and removed the requirement to verify that the 
contractor’s Central Contractor Registration is current. The policy 
memorandum states that this scope of work performed does not 
constitute an audit or attestation engagement under GAGAS. 

It is within DCAA’s purview to determine whether these procedures 
constitute an audit. However, because direct-bill decisions present a 
risk of undetected improper contract payments, prudent decisions to 
continue a contractor’s chrect-bill authorization would necessarily be 
based on testing a statistical sample of invoices® and include a review 


** GAO-07-7;n('T, § 3.38 and AU § 333.12. 

® Disbursing ofllcers are aulhorized to make payments on the authority of a voucher 
certified by an authorized ceitifying ofTicer, who is responsible for the legality, accuracy, 
and propriety of the payment. 31 U.S.C. §§ 3325, 3527(c). DOD 7000. J4-B, Department of 
Defense Financial Management Regulat ion (DFMR), Vol. 5, Ch. 1 1 (March 2009), paras. 

1 10102, 1 10203. In general, certifying ofTicers designated in writing by the agency are 
financially liable for any improper, illegal, or incorrect payment made, and each payment 
made must be audited (or “examiiied"). 01 U.S.C. §§ 3521(a), 3528(a). DFMR, Vol. 5, Ch. 33 
(April 2005), para 330303. However, 31 U.S.C. § 3521(b) authorizes heads of agencies to 
carry out a statistical sampling procedure, within certain parameters, to audit vouchers 
when the head ofihe agency determines that economies will result. Further, 31 U.S,C. § 
3521(e) provides that certifying and disbursing officials are not liable for payments that are 
not audited if they were made in good faith under a statistical sampling procedure. See 68 
Comp. Gen. 618 (1989); also see generally, GAO, Policy and Procedures Manual for 
Guidance of Federal Agencies, 7, §§ 6.5, 7.4, and 7.5 (Washington, D.C.; May 18, 1993). 
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of supporting documentation, including documentation to confirm the 
government received goods and services noted on the billing invoice. 
We confirmed that Defense Finance and Accounting Service certifying 
officers rely on DCAA reviews, and they do not repeat review 
procedures they believe to be performed by DCAA. 


Human Capital The DBB made two recommendations to improve DCAA human capital 

Management and Cultural management and agency culture, namely that DCAA (1) develop a human 
Transformation capital strategic plan as a key tool to facilitate human capital management 

and workforce development and (2) engage an external professional 
organization to assist in a cultural transformation that includes 
emphasizing core values such as quality, independence, ethics, and 
objectivity rather than a mindset focused on quantity and productivity. 
DCAA has not yet developed a human capital strategic plan as a key tool 
to facilitate human capital management and workforce development In 
May 2009, DCAA finalized an agreement with the Naval Post Graduate 
School, Center for Defense Reform, for assistance on cultural reform. 
According to GAO’s Internal Control Standards” operational success is 
possible only when the right personnel for the job are on board and are 
provided the right training, tools, structure, incentives, and 
responsibilities. Accordingly, management should ensure that skill needs 
are continually assessed and that the organization is able to obtain a 
workforce that has the required skills that match those necessary to 
achieve organizational goals. In addition, training sho\ild be aimed at 
developing and retaining employee skill levels to meet challenging 
organizational needs; qualified and continuous supervision should be 
provided to ensure that internal control objectives are achieved; and 
performance evaluation and feedback, supplemented by an elective 
reward system, should relate employee performance to the organization’s 
success. 

Lack of a human capital strategic plan. The lack of a human capital 
management strategic plan has bmited the effectiveness of DCAA’s hiring, 
training, and staff development efforts. DCAA officials told us they view 
contract auditing as a highly specialized profession that requires 
knowledge of acquisition law and regulations and government 
procurement and contract management processes. As a result, DCAA 
officijds believe that auditors must be hired at the entry level and trained 


®®GAO/AIMD-Ol>.21.3.l. 
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to perform contract audits. The officials also believe that because DCAA is 
the only contract audit agency in the federal government and it operates 
the only federal contract audit training institute, DCAA is in the best 
position to train contract miditors. However, DCAA is not the only agency 
that performs contract audits. Many IG offices, including the DOD IG, the 
military service audit agencies, several executive agency IGs, and GAO all 
perform contract audits. Further, DCAA has not provided training that is 
designed to develop contract audit skills at succe^ively higher levels, and 
it has not provided adequate or continuous supervision of audit staff. 
Moreover, our work has shown that performance evaluations and 
feedback have not always related performance to the agency’s success, as 
was the case when supervisors who were responsible for improperly 
dropping audit findings and changing draft audit opinions received high 
performance evaluations and cash awards. 

At the September 2008 hearing, the DCAA Director acknowledged the 
need to develop revised training to address audit quality issues. However, 
it will take considerable time to develop a revised training program to 
address the range of changes in audit policies, processes, and procedures 
for performing quality audits in accordance with GAGAS. However, on 
April 8, 2009, DCAA revised its Supervisory Development Training 
Curriculum to emphasize leadership skills and better reflect the day'today 
activities performed by supervisors. This revision was based on feedback 
received through E)CAA’s suggestion program, anonymous Web site 
contacts, and focus groups and is not based on a study or expertise of an 
outside professional organization. In addition, DCAA has begun a 
reassessment of the 2'Week technical indoctrination class for new hires. 

Although it is appropriate to consider staff input in developing training 
courses, the development of in-house training by agency personnel may 
not result in a design that encourages participants to develop more critical 
analysis of the underlying principles or ways to bring about organizational 
change. Outside ejqiertise helps ensure that an organization benefits from 
outside subject matter experts as well as education and training 
professionals who have a broad perspective on innovative ^proaches to 
best practices or best learning design. 

DCAA has difficolty identifying an independent professional 
organization to a^ist in cultural transformation. According to the 
DCAA Director, DCAA faces challenges in engaging a professional 
organization to assist witti cultural change because (1) many external 
organizations that provide this service are audited by DCAA and to 
preserve the appearance of independence under the auditing standards, 
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DCAA cannot engage organizations that it audits and (2) based on initial 
discussions with various organizations, DCAA believes this effort could 
cost from $1 to $2 million or perh^s more and DCAA would need 
additional funding to pay for this assistance. However, based on an 
assumption that DCAA would receive funding for this effort, the Director 
established a completion date of January 2010 with training of the 
workforce potentialh^ extending into fiscal years 2011 and 2012. In the face 
of these challenges, the DCAA Director took action on three other 
initiatives related to cultural change. The DCAA Director stated that 
shortly after issuance of our July 2008 report, DCAA initiated a 1- to 2-year 
project to accomplish an organizational assessment using the Baldrige 
National Quality Program*' criteria with assistance from Baldrige experts 
within the Army. In addition, as required by the DOD Comptroller/CFO in 
September 2008, the Director asked the Office of Personnel Management 
to conduct an independent organizational survey of DCAA. As previously 
discussed, to help ensure that DCAA’s new performance metrics resulted 
in appropriate cultural change with regard to the new emphasis on audit 
quality, DCAA established an anonymous Web site for obtaining feedback 
on the iniq>propriate use of the performance measures. 

In May 2009, DCAA asked the Naval Postgraduate School, Center for 
Defense Reform to assist DCAA with cultural transformation as 
recommended by the DBB. The Center began work in June 2009 to help 
DCAA identify issues facing the organization and develop an action plan. 

Delay in reporting results of DCAA's organizational survey. DCAA’s 
independent organizaticmal survey was completed during the fall of 2008, 
and DCAA officials said the assessment results would be finalized in 
March 2009, but then amended the date for completing the assessment of 
the survey results to late July 2009. Therefore, the survey results were not 
available to us for review. 

DCAA’s anonymous Web site contacts underscore the need for a 
separate hotline office. DCAA’s anonymous Web site was established as 
a mechanism for monitoring compliance with DCAA’s new performance 
metrics; however, it has become an internal hotline, with many auditors 


The Baldrige National Quality Program is named for Malcolm Baldrige, a former 
Secretary of Commerce, who was a proponent of quality management as a key to national 
prosperity and long-tenn strength. The seven Baldrige performance excellence criteria are: 
leadership; strategic planning; customer and market focus; measurement, analysis, and 
knowledge management; workforce focus; process management; and results. 
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reporting the same issues as those presented in hotline complaints 
received by GAO. The DBB report stated that DCAA would benefit from 
the establishment of a Chief of Internal Review to perform critical 
inspector general functioas, such as performing periodic reviews and 
evaluations, serving as an ombudsman between staff and DCAA 
management, and addressing hotline complaints. Instead of establishing a 
separate Internal Review function, in March of 2009, the DCAA Director 
divided responsibilities of its Operations Directorate between the 
Operations Assistant Director and Deputy Assistant Director to provide 
dedicated staff to handle auditor concerns reported to the internal DCAA 
anonymous Web site. DCAA’s Assistant Director of Operations along with 
a Division Chief and three program managers were made responsible for 
the DCAA hotline function, and the Deputy Assistant Director of 
Operations was given responsibility for day-to-day operations, 

Oui' review of DCAA headquarters handling of DCAA auditor concerns and 
hotline allegations sent to DCAA’s anonymous Web site determined that 
internally reported DCAA auditor concerns represent problems across all 
five DCAA regions. As with GAO hotline complaints, the largest number of 
problems reported to DCAA’s anonymous Web site related to DCAA's 
Western Region. Our review of DCAA documentation and discussions witii 
auditors and DCAA officials indicate that current handling of internally 
reported DCAA auditor concerns and allegations appears to be timely, 
objective, and fact-based. The Assistant Director of Operations has made 
good progress in establishing credibility and trust in the DCAA hotline 
function. It will be important for any future inspector general or 
ombudsman to cany forward in this role. The DCAA Director’s response 
to the DBB report did not address the recommendation to establish a 
Chief of Internal Review. We agree with the DBB recommendation. It is 
important for DCAA to have a hotline function that is separate from 
management and operations. Currently, the Operations Assistant Director 
has been reassigned to handle this function on a temporary basis. 
However, given the size of the DCAA organization, the extensive number 
of internal DCAA hotline complaints — which totaled about 150 at the end 
of May 2009 — ^and the likelihood of continuing hotline contacts that would 
need to be addressed as DCAA undergoes its cultural transformation, a 
permanent internal review or inspector general function is warranted. 
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Legislative and Other 
Actions To Improve 
DCAA’s Effectiveness 
and Independence 


In addition to correcting ihe fundamental wealoiesses in mission and the 
overall management environment discussed above, certain legislative and 
other actions, such as changes in organizational placement, could enhance 
DCAA’s effectiveness and independence. Successful management 
initiatives for cultural and organizational change in large private and 
public sector organizations can often take several years to accomplish. 
Changing DCAA’s organizational placement without first correcting 
fundamental weaknesses in mission and the overall management 
environment would not assure effective audits. Given this time frame and 
pursuant to your request, we identified legislative and other actions that 
decision makers can consider to improve DCAA’s effectiveness. In the 
short term, Congress could enhance DCAA’s effectiveness and 
independence by granting DCAA certain authorities and protections 
similar to those offered to presidentially appointed inspectors general 
under the Inspector General Act of 1978, as amended” (IG Act). The IG 
Act contains provisions that enhance the independence of presidentially 
appointed IGs, including protections from removal without congressional 
notification, access to independent legal counsel, public reporting of audit 
results, rights to take statements from contractor and other personnel, and 
budget visibility. These provisions would enhance the important DCAA 
initiatives currently under way. Continued monitoring and oversight wiU 
be essential to assuring the successful implementation of DCAA’s 
management initiatives. In the longer term, Congress could consider 
changes in organizational placement alter current reform efforts have 
been effectively implemented. However, moving DCAA as an organization 
would require careful analysis and planning before implementation. 


Short-Term Legislative in addition to DCAA management reforms already under way and our 

Actions additional recommend^ions, we identified certain legislative protections 

and authorities under the IG Act that could enhance DCAA’s effectiveness. 
Legislation would be needed in order to grant DCAA such protections and 
authorities. 

Leadership. The IG Act provides for the President to appoint the IG, with 
Senate confirmation, at many federal agencies.” Under the act, Congress 
must be notified in advance of removing the IG, and only Congress can 


” Codified in an appendix to Title 5 of the United States Code (hereafter 5 U.S.C. App.). 

” The IG Art also requires the heads of many “designated federal entities" to appoint an 
inspector general for each entity. 5 U.S.C. App. 8G. 
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eliminate the office of an IG. Currently, the head of DCAA is appointed and 
can be removed by the Secretary of Defense. Further, DCAA was created 
and can be reorganized or reassigned by departmental order without 
notice. IG Act protections Congress could grant to DCAA would therefore 
include (1) Senate confinnation of a presidentially appointed DCAA 
Director*^ and (2) removal of the DCAA Director conditioned on 
congressional notification. * Specifically, the act provides that an 
inspector general may be removed from office by the President and any 
removal is to be reported to both Houses of Congress 30 days prior to the 
removal. In addition to these IG Act protections, Congress could build 
additional provisions into legislation, to include the following; 

• Requirements tlwit the DCAA Director possess the appropriate 
professional qualifications. For example, provisions for appointment of 
the DCAA Director could require selection from among individuals 
who possess demonstrated ability in managing and leading 
organizations, specific accounting or auditing background, general 
knowledge of contract management, and knowledge of and extensive 
practical experience in financial management practices in large 
governmental or business entities. 

• A mandate permitting the DCAA Director to hold a renewable term 
appointment for between 5 to 7 years. Legislation should provide that 
the DCAA Director can be removed only for cause or other stated 
reasons. These protections would aUow the head of DCAA to provide 
stability and continui^ of leadership that span presidential 
administrations and prevent removal except for cause or other 
disclosed reasons. 

• Conflict of interest provisions for the DCAA Director and other key 
staff in addition to ^c«e provisions currently in law. This would be 
intended to ensure that selection of the audit agency head would not 
involve a “revolving door” situation between contractors and the 
contract audit agency. 


Access to independent legal counsel. The IG Act provides for 
independent legal advice for IGs rather than requiring the use of agency 


5 U.S.C. App. § 3(a). 
” 5 U.S.C. App. § 3(b). 
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legal counsel.®® Currently, DCAA relies upon DOD legal counsel. DCAA 
officials told us that the DCAA Director has not always been apprised of 
legal decisions by DOD counsel that have impacted DCAA operations. 
Further, according to the DCAA Director, the lack of independent counsel 
led to a situation where DOD attorneys provided questionable legal 
counsel to a DCAA field office supervisor without the DCAA Director’s 
knowledge. Obtaining independent legal counsel would avoid conflicts of 
interest between DOD and DCAA, thereby helping to improve DCAA’s 
effectiveness. 

Budget. The IG Act requires separate budgets for Offices of Inspector 
General (OIG) within agency budgets, allowing Congress to review IG 
budget requests separately. DCAA currently does not have this protection. 
IGs that are appointed by the President with Senate confirmation receive a 
separate appropriation, preventing agencies from reprogramming IG funds 
to other programs and activities. However, there is currently little visibility 
of DCAA’s budget because it is funded under the Operations and 
Maintenance, Defense-wide appropriation, which includes numerous DOD 
agencies, such as the Defense Contract Management Agency (DCMA), the 
Defense Logistics Agency, the Defense Finance and Accounting Service, 
and some buying command activities. Therefore, DCAA’s share of annual 
appropriations is subject to reprogramming, sometimes without 
congressional notification. According to the DCAA Director and 
documentation provided by the Director and Office of Comptroller/CFO, 
in the past, DOD has reprogrammed funding between DCAA and other 
DOD activities on numerous occasions. Because these reprogrammings 
were below the $15 million threshold for congressional notification, 
Congress did not have notice of these funding decreases at the time they 
occurred. For fiscal year 2009, DOD reprogramming increased DCAA’s 
funding by $3.5 million. Legislation siniilar to the IG Act could grant DCAA 
a separate budget*" to provide visibility and protections from 
reprogramming of funds to other agency priorities. 

Increased authority and independence. Legislation could strengthen 
DCAA’s audit authority by providing the same level of access to records 
and personnel avculable to IGs.** Currently, DCAA has statutory rights of 


* 5 US.C. App. § 8F(4)(A). 

®^5US-C. App- §6(0(1) 

“ 5 U.S.C. App. § 6(a)(i), (4). and (5). 
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access to certain records related to cost-type contracts or those that 
contain cost and pricing data, but not to contractor personnel. As a result, 
DCAA’s subpoena power is limited to certain records and does not cover 
contractor personnel. While we recognize that DCAA auditors have 
ongoing discussions with contractor personnel, they do not have statutory 
authority to compel contractor officials to meet with them and submit to 
interviews. IGs have authority, including subpoena power, to access all 
records, reports, audits, reviews, documents, papers, recommendations, or 
other material available that relate to programs and operations for which 
the IG has responsibilities. Further, IG subpoena authority extends beyond 
access to records and documents in that IG auditors can administer or 
take an oath in order to obtain information. Our discussions with DCAA 
auditors and reviews of audit documentation identified numerous 
instances where requests for contractor records were not met.®* Obtaining 
increased access to contracting companies, especially their staff and 
documentation, would be an important provision to improve the 
effectiveness of DCAA audit staff. 

Reporting and oversight of audit results. The IG Act provides for 
semi-annual reports to the agency head and appropriate committees of 
Congress summarizing results of significant audits and investigations. 
DCAA currently has no external reporting requirement, reducing 
opportunities for oversight and transparency. Congress could mandate 
some form of external DCAA reporting in legislation similar to the IG Act. 
Moreover, DCAA does not currently provide copies of its audit reports to 
other federal agencies that use the same contractors that DOD uses. 
According to the DCAA Director, DCAA’s appropriations are specific to 
DOD contractor audits, and unless federal agencies request and reimburse 
DCAA for audit services, DCAA cannot provide them with copies of its 
audit reports even though its DOD audits of systems and related internal 
controls, cost accounting system compliance, etc. may cover their 
contractors. Legislation could also expressly allow DCAA to provide audit 
results to other agencies, a step that would improve Its visibility and 
effectiveness for the government as a whole. 


” As noted previously, in these cases, there was no evidence that DCAA supervisors 
elevated the issue to management or to procurement officials to initiate enforcement 
action, as set out in E)CAA policy. 

5 U.S.C. App. § 5(a). 
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Legislation to grant DCAA sinular protections and authorities as those 
provided in the IG Act could enhance reform efforts that are already under 
way. Although we found that a lack of DOD Comptroller/CFO and IG 
oversight has impaired DCAA’s effectiveness, DOD has begun work to 
provide improved oversi^t of DCAA’s operations. In August 2008, the 
DOD Comptroller/CFO conducted a “tiger team” review of DCAA’s audit 
quality assurance program, and DOD approved a more comprehensive 
Defense Business Board (DBB) study. The new DOD ComptroUer/CFO 
recognized the need for DCAA oversight and on March 16, 2009, approved 
the charter for a DCAA Oversight Committee. Committee members include 
the Auditors General of U\e Army, the Navy, and the Air Force; the DOD 
Director of Defense Procurement and Acquisition Policy; and the DOD 
Deputy General Counsel for Acquisition and Technology. The Committee 
held its first meeting in early April 2009. During May 2009, the DCAA 
oversight committee members reviewed selected DCAA audits and visited 
a DCAA field office. In addition, the committee members have indicated 
that they plan to review this report, our earlier investigative report, the 
DOD Comptroller/CFO “tiger team” report, the DBB report, and the 
upcoming DOD IG report that follows up on issues from our July 2008 
report. The committee plans to assess DCAA actions on recommendations 
in these reports and identify any gaps for further action. We note that 
DCAA has already taken numerous actions to respond to our initial 
investigative report as well as DOD ComptroUer/CFO and DBB 
recommendaUons. 


Long-Tenn Legislative Most of the impairments to DCAA effectiveness that we identified can be 

Actions To Move DCAA addressed svit^ DCAA’s current organizational placement. However, to 
address the Committee’s interest in how changes in DCAA’s organizational 
placement could improve DCAA effectiveness and independence, we 
considered potential approaches to moving DCAA. During the 1980s, there 
were numerous proposals to reorganize DCAA’s organizational structure, 
including legislative proposals that would have placed DCAA in the Office 
of the Under Secretary of Defense (Acquisition), or in the DOD Office of 
Inspector General (OIG), or placed only DCAA's post-contract audits in 
the OIG. We analyzed these proposals in an April 1991 report’®' and 
concluded that they were not workable because they posed conflict of 
interest or duplication of effort issues. 


'®* GAO, Defense Contract Avdits: Current Organizational Relationships and 
RespoTisibilities, GAOAFJtD-91-l4 (Washington, D.C.: Apr. 3, 1991). 
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We believe that it is prudent to consider changes in organizational 
placement after DCAA has had sufficient opportunity to effectively 
implement current reform efforts necessary to address fundamental 
operational issues. Legislation to move DCAA as an organization would 
require careful analysis and planning before implementation. Moving 
DCAA at this time would be a bold step with possible unintended 
consequences, and decision makers would need to carefully weigh the 
costs and benefits of moving DCAA before the fundamental operational 
issues are addressed. As discussed below, regardless of its ultimate 
placement in the government, DCAA still needs to address the 
fundamental weaknesses in its mission, strategic plan, metrics, audit 
approach, and human capital management. 

Elevating DCAA within DOD Elevating DCAA within DOD as a separate component reporting to the 
Deputy Secretary of Defense could give more authority to the DCAA 
Director and increase visibility of the organization both within and outside 
of DOD.'® Because DOD positions reporting to the Secretary level are 
established by law, moving DCAA to the department level would require 
new legislation. To avoid any ambiguities or questions about whether the 
Secretary of Defense currently possesses the statutory authority to 
transfer the supervision of DCAA to the Deputy Secretary, we believe 
additional legislation th^usets out appropriate relationships would be the 
best approach.'® In addition, this option would require some level of 
administrative change. For example, management and oversight of the 
contract audit function would become the responsibility of Deputy 
Secretary, a separate appropriation would need to be established, and 
some form of periodic external reporting to Congress would be 
appropriate. We note that authorizing legislation to move DCAA could also 
include similar protections and authorities as those tinder the IG Act if 
these provisions have not already been enacted. 


The Deputy Secretary of Defense is appointed by the President after confumation by the 
Senate. 10 U.S.C. $ 132(a). Among other duties as assigned by the Secretary of Defense and 
in statute, the Deputy Secretary serves as the Chief Management Officer of the department 
with primary respoirability for ‘'effectively and efficiently organiz{ing] the bminess 
operations of the Depanm«^t of Defense." Pub. L No. 110-181, div A, title IX, § 904(a)(2) 
(Jart 28, 2008). In that capacity, the Deputy Secretary is to be assisted by a Deputy Chief 
Management Offtcer, who also is appointed by the President after conilrmation by the 
Senate, and who supervises tiie Defense Business Transformation Agency. 10 U.S.C. §§ 
132(c), 192(e). 

Current provisitms of law relevant to the Secretary of Defense establishing and assigning 
deferrse agerrcies aird deferr^ field activities within the Office of the Secretary of Defense 
include lOU-S.C. 5§ 125(a), 131(b), 191(b), 192(a), and 194. 
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Although this option could enhance DCAA auditor objectivity and 
independence, under this organizational placement, DCAA w'ould still 
need to resolve the management environment and cultural problems that 
have had a negative impact on audit quality, including pressure by 
contractors and contracting officers on audit scope and findings, 
conclusions, and recommendations. DCAA also would need DOD 
commitment to strengthening DCAA's contract audit function through 
continued monitoring and oversight Leadership from the Deputy 
Secretary of Defense would be critical to help DCAA address these 
matters. A key factor will be whether the Deputy Secretary has the 
necessary time to focus on DCAA. The amount of time needed should be 
less once the fundamental improvements are accomplished. 

Establishing an Independent, Numerous govemmentwide acquisition management reform efforts are 

Govemmentwide Contract currently under way that could impact the contract audit function. These 

Audit Agency efforts include congressi<mal oversight and reform legislation and 

Presidential direction on develc^ing govemmentwide guidance for 
reviews of existing contracts to identify contracts that are wasteful, 
inefficient, or otherwise unlikely to meet agencies’ needs, and to formulate 
corrective action in a timely manner, as well as interest group studies. For 
example, in the National Defense Authorization Act for Fiscal Year 2008, 
Congress created the Commission on Wartime Contracting to study 
federal agency contracting for the reconstruction, logistical support of 
coalition forces, and the performance of security functions in Iraq and 
Afghanistan. The Senate Committee on Homeland Security and 
Governmental Affairs also recently created a new Subcommittee on 
Contracting Oversight. Several Members of the House Oversight and 
Government Reform Committee created the Clean Contracting Coalition 
to take a similar govemmentwide approach. The House Oversight and 
Government Reform Committee also has been very active In this area. In 
addition, the House Armed Services Committee established an acquisition 
panel to evaluate DOD’s current acquisition system, analyze the root 
causes of project or program failures, and the administrative and cultural 
pressures that acquisition and program personnel face. The House and 
Senate Armed Services Committees also led the effort to enact the 
Weapon Systems Acquisition Reform Act of 2009,'“ which requires 
oversight of cost estimation, systems engineering, and performance 
assessment; promotes competition; and limits organizational conflicts of 
interest. 


Pub. Law No. 111-23, 123 Stat. 1704, May 22, 2009. 
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On March 4, 2009, the President issued a memorandum directing executive 
agencies to (1) increase the use of fixed-price contracts, (2) enhance the 
capacity of the acquisition workforce, (3) maximize competition, and 
(4) rationalize the choice of government or contractor resources to 
perform required services. In addition, the Federal Acquisition Innovation 
and Reform Institute — a nonpartisan, nonprofit organization led by leaders 
in acquisition and supply management — has called for acquisition 
workforce reforms, including a single acquisition job series that 
encompasses at a minimum, three functions — program management, 
contracting, and a new function called requirements management — and is 
considered a professional “super COTR" (contracting officer’s technical 
representative) position. Over the next several years, these reform 
initiatives likely will have a significant impact on government contracting, 
including the roles and relationships of contract auditors and the 
contracting, program, and finance communities. 

Depending on the outcome of the various contract reform initiatives and 
the successful implementation of DCAA management reforms, Congress 
may also want to consider increasing the efficacy of these reforms by 
establishing an independent govemmentwide contract audit agency. The 
creation of a statutory govemmentwide contract audit agency could 
enhance contract auditor effectiveness and independence by placing the 
audit agency outside DOD and other federal agencies that make 
procurement and contract management decisions. Centralizing the 
contract audit function and mandating its use by all federal agencies also 
could provide for consistent audit coverage and bring efficiencies and 
economies of scale to the contract audit process across the government. 
However, this would likely entail significant costs and operational and 
accountability considerations and would be an extremely costly option 
involving significant infrastructure and reorganization and would require 
substantial planning and analysis before deciding whether to proceed and 
how to implement any changes. Some of the issues that would need 
further study smd analysis include the following: 

Governance. Governance is the framework of rules and practices by 
which a governing body, such as a board of directors, ensures 
accountability, fairness, and transparency in the entity’s relationship with 
all of its stakeholders, including management, employees, and 
government. In order to improve governance and accountability at federal 
agencies, a variety of laws covering a range of management and 
administrative practices and processes have been enacted. Consideration 
of such provisions for a govemmentwide contract audit agency should 
include jqjplication of general laws related to funds control, performance 
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and financial reporting, ^counting and internal control systems, human 
resources man^ement, and recordkeeping and access to information, 
among others. Further, governance issues unique to a contract audit 
agency, such as its relationships to agency contracting officers and the 
Congress, should be assessed. 

Scope of Work. Scc^e of work considerations would include roles, 
responsibilities, and relationships of the govemmentwide contract audit 
agency and IGs with regard to contract audits. Another consideration 
would be whether the new agency would be available for consultation as 
an outside expert on federal agency pre-award issues. In addition, a 
determination would need to be made on the handling of fraud referrals. 
For example, the central new agency could have an investigative division 
or it could refer potential contract fraud to federal agency IGs for further 
investigation. 

Funding. Congress would need to determine how to fund the new 
contract audit agency. For example, funding could be provided through 
appropriations or from reimbursement by federal agencies. This decision 
would likely be tied to decisions on the govemmentwide contract audit 
agency’s mandate and scope of work and any realignment of contract 
audit resources. 

Further study and analysis of this option would involve input from the 
federal agency IGs and agency contracting and finance communities as 
well as government contractors and public interest groups. Numerous 
additional issues would potentially be identified and require substantial 
time and cost for effective consideration and resolution. 


Conclusions 


Successful accomplishment of DCAA reforms will require focused and 
committed leadership at the highest levels of DOD and DCAA as well as 
fundamental changes in DCAA’s culture and possible congressional action. 
Without leadership commitment to a strong contract audit function and 
subst^mtial changes to DCAA’s mission, strategic plan, and management 
environment and culture, DCAA will continue to be ch<illenged in its 
ability to perform quality audits that protect the public interest Many 
needed changes are planned or under way and can be completed in the 
short-term, including revising DCAA’s mission statement, strategic plan, 
and monitoring, and adjusting performance metrics. Fundamental 
structural and cultural changes related to developing and implementing a 
comprehensive, risk-based approach for contract audits that comply with 
professional auditing standards and identifying staffing, training, and 
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resource needs will tjUce several years to accomplish and implement. 
However, unless the overall problems with DCAA’s culture and 
management environment that resulted in pervasive contract audit failures 
are resolved, billions of taxpayer dollars will continue to be at risk for 
fraud, waste, abuse, and mismanagement. 


Recommendations for "S is recommendations to the SecretaiT of Defen^ to 

improve the quauty of the agency s audits and strengthen auditor mtegnty, 
EX6CUtiV6 Action objectivity, and independence, including recommendations for actions on 

findings in this report that are aligned with certain Defense Business 
Board (DBB) Hndings and recommendations. 

First, we recommend that the Secretary of Defense revise DCAA’s mission 
statement to reflect the need for quality contract audits and related 
nonaudit services that take into account serving the public interest 

We also recommend that the Secretary of Defense require the Under 
Secretary of Defense (ComptroUer/CFO) to establish milestones for 
completing EKDAA corrective actions and monitor and regularly report on 
DCAA progress to assure timely completion of critical actions. 

In addition, we recommend that the Secretary of Defense direct the Under 
Secretary of Defense (ComptroUer/CFO) to require the Director of the 
Defense Contract Audit Agency (DCAA) to take the following 13 actions. 

The following five recommendations cover actions to address our findings 
that are similar to DOD ComptroUer/CFO and DBB findings. 

* In concert with the revised mission statement, develop a strategic plan 
with short-term and long-term outcome-related goals. 

• To measure progress in achieving strategic goals, ensure that metrics 
are tied to the revised mission statement and strategic plan and 
support the agency’s annual work plan. 

» Consult with DOD stakeholders and engage outside experts to develop 
a risk-based contract audit approach that identifies resource 
requirements and focuses on performing quality audits that meet 
generally accepted government auditing standards (GAGAS). 
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• Establish an SES-level position with responsibility for audit quality 
assurance that require demonstrated knowledge and experience in 
applying professional audit standards. 

• Consistent with DBB report observations, establish a separate DCAA 
internal review organization to conduct critical internal inspector 
general functions, including performing periodic internal evaluations 
and reviews and addressing DCAA hotline complaints. 

The following eight recommendations relate to specific GAO findings in 

this report 

• In consultation with DOD stakeholders, review DCAA's current 
portfolio of audit and nonaudit services to determine if any should be 
transferred or reassigned to another DOD agency or terminated in 
order for DCAA to comply with GAGAS integrity, objectivity, and 
independence requirements. 

« Based on the risk-based audit approach, develop a staffing plan that 
identifies auditor resource requirements as well as auditor skill levels 
and training needs. 

• Establish a position for an expert on auditing standards or consult with 
an outside expert on auditing standards to assist in revising contract 
audit policy, providing guidance on sampling and testing, and 
developing training on professional auditing standards. 

• Revise DCAA audit policy to provide appropriate guidance on what 
constitutes sufficient testing to comply with GAGAS. Update DCAA’s 
Contract Audit Manuai, as appropriate. 

• Develop agencs^wide training on government audit standards. This 
training should emphasize the level of assurance intended by the 
various types of engagements and provide detailed guidance on auditor 
independence, planning, fraud risk, level of testing, supervision, 
auditor judgment, audit documentation, and reporting. 

• Conduct a comprehensive, independent review of DCAA’s revised audit 
quality assurance function. This review should focus on the consistent 
application of criteria used for assessing audit quality and assuring 
timely, consistent, and appropriate reporting of review results. 

• Make appropriate recommendations to address annual quality 
assurance review findings of serious deficiencies and GAGAS 
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noncompUance, provide tr^ning, and follow-up to assure that 
appropriate corrective actions have been taken. 

• Establish policies and procedures to ensure that auditors who make 
direct bill decisions are independent of DCAA employees who perform 
a DOD management function by reviewing vouchers of contractors not 
eligible for the direct billing program, thereby reducing situations 
where DCAA auditors are encouraged to reduce their office workload 
by 2 ^proving contractors for the direct-bill program. 

F\uther, we recommend that the Department of Defense Inspector General 

take the following two actions. 

• Reconsider its overall conclusions in the May 2007 DOD IG report on 
the audit of DCAA’s quality control system in which it reported an 
adequate (“clean”) opinion on DCAA system of quality control in light 
of the serious deficiencies and findings included in that report and the 
additional evidence identified in our audit. 

• Based on the above, determine whether the report should be rescinded 
or modified. 


Matters for 

Congressional 

Consideration 


In addition to our recommendations to DOD for improving DCAA audit 
quality and auditor objectivity, integrity, and independence. Congress may 
wish to consider the following legislative actions for enhancing DCAA’s 
effectiveness and independence. In considering these options, the 
Congress would need to weigh DCAA’s ability to accomplish significant 
reforms within its current environment and the cost and administrative 
effort involved with the alternative options along with the potential 
benefits. Timing would ^so need to be considered, given significant 
reforms that DCAA is already undertaking and the addition^ burden that a 
change in organizational placement would add at this time. 

• In the short term, as DCAA makes progress in correcting fundamental 
weaknesses that have impacted audit quality, Congress could consider 
enhancing DCAA reform efforts by enacting legislation to grant it 
protections and authorities similar to those embodied in the Inspector 
General Act, as amended. 

• In the medium term. Congress could consider elevating the contract 
audit function within DOD by moving DCAA from under the DOD 
Comptrol!er/CFO and placing it under the Deputy Secretary of 
Defense. 


Page 72 


GAO-09'468 DCAA Audit Envlronmeut 


13:37 Apr 18, 2011 Jkt 053841 


PO 00000 Frm 00214 Fmt6601 Sfmt 6601 


P:\DOCS\53841.TXT SAFFAIRS 


PsN: PAT 



211 


In the longer term, depending on the outcome of acquisition 
management reform initiatives under way and the success of DCAA 
management reforms, Congress could consider creating an 
independent, govemmentwide contract audit agency. Legislation to 
move DCAA should incorporate the protections and authorities similar 
to those embodied in the Inspector General Act, if these have not 
already been granted to DCAA. 


Agency Comments 
and Our Evaluation 


We made a total of 17 recommendations, including 15 recommendations to 
DOD to improve DCAA’s management environment, audit quality, and 
oversight; and we made 2 recommendations to the DOD IG regarding 
DCAA’s last peer review. We received written comments from the 
Department of Defense (DOD) on September 8, 2009, and we received 
written comments from the DOD Inspector General (IG) on September 3, 
2009. DOD stated that the department concurs with all but one of our 15 
recommendations. DOD also stated that the Department and DCAA are 
committed to taking the necessary corrective actions to address our 
findings and that the department will continue to monitor DCAA to ensure 
timely completion of critical actions to address our recommendations. 
DOD also provided comments on our matters for congressional 
consideration. Although DOD disagreed with the matters we discussed, we 
continue to believe these are valid matters for congressional 
consideration. The DOD IG concurred with our recommendation to 
reconsider the conclusions in its May 2007 peer review report on DCAA; 
the IG did not concur with our recommendation to determine whether to 
rescind or modify its peer review report. DOD’s written comments are 
reprinted in 2 q)pendix IV, and the DOD IG’s written comments are 
reprinted in appendix V. We summarize and evaluate the DOD and DOD IG 
comments and responses to our recommendations below. We made 
technical corrections and clarifications suggested by DOD in the body of 
our report, where appropriate. 


DOD Comments and Our 
Response 


DOD’s written comments include (1) comments on our 15 
recommendations, (2) comments on matters we presented for 
congressioncii consideration, (3) a list of DCAA corrective actions, 

(4) DCAA clarifications, and (5) comments from the Director, Defense 
Procurement and Acquisition Policy. DOD officials fiilly concurred with 13 
of our 15 recommendations for improving DCAA audits, partially 
concurred on one recommendation, and did not concur with one 
recommendation. We view DOD comments as being generally responsive 
to the intent of our recommendations. Our discission of DOD’s response 
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to our matters discussion and our findings and recommendations follow. 
We provide additional comments on specific sections of the DOD response 
letter in appendix IV. 

With regard to the matters we presented for congressional consideration, 
DOD stated that it generally opposes providing DCAA with authorities 
similar to fiiose contained in the Inspector General Act. DOD stated that it 
specifically opposes certain recommendations based on the IG model if 
DCAA remains within DOD, including (1) a Presidentially-^pointed and 
Senate-confirmed DCAA Director, unless DCAA is independent of DOD, 

(2) fixed terms for the DCAA Director, (3) an independent budget, and (4) 
mandatory public reporting. DOD also stated that it plans to take steps to 
strengthen DCAA’s independence by establishing an appeals process that 
permits DCAA to seek resolution when there are differences of opinion as 
to the resolution of its audit findings. Finally, DOD opposes moving DCAA 
from under the DOD CoinplroUer/CFO and placing it under the Deputy 
Secretary. DOD pointed out that the Deputy Secretary is the Chief 
Management Officer of one of the world’s largest organizations and backs 
up the Secretary in the wartime chain of command, and he does not have 
the time to provide oversight and support to individual defense agencies. 

Although DOD did not agree with these matters, we believe they provide 
important information for Congress to consider. For example, the 
Inspector General Act provides many important authorities and 
protections for IG’s that could enhance DCAA’s independence and 
effectiveness. DOD disagreed with the Presidential appointment and 
Senate confirmation provision because it believes this would inject a 
political element into DCAA that is not appropriate and could create 
lengthy periods where there is no Director. DOD also opposes fixed terms 
for the DCAA Director because it believes the Secretary of Defense must 
have the ability to choose an appropriate Director. Our position with 
regard to appointments of IGs has been that Presidential appointments 
with Senate confirmation enhance their independence from the entities 
they audit and investigate. We recognize that DCAA serves a different role 
than IGs. We looked to the IG Act model to identify provisions that 
enhance the independence of auditors. A political appointment would 
elevate the status of the Director among DCAA’s stakeholders and, as a 
consequence, give DCAA more authority to respond to actions taken by its 
stakeholders to influence its independent audit work. A fixed term would 
provide stability, especially during a time of organizational change. DOD 
also questioned the wisdom of an independent budget because it would 
limit its ability to move money into DCAA, as is occurring now based on 
funding from the Defense Acquisition Workforce Development Fund. 
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Separate appropriations are a key independence provision for IGs. The 
ability to reprogram funds within the Defense-wide Operations and 
Maintenance appropriation can involve both increases and decreases. Our 
analysis of DCAA reprogrammings over the last three years showed that 
funds were also moved from DCAA to other DOD organizations within the 
Defense-wide operations and maintenance appropriation. In DCAA’s case, 
the reprogrammings to reduce funding generally related to large 
unobligated balances — showing that DCAA under executed its budget. We 
believe this is important information that Congress would want to know. 
Further, we do not see a reason why DOD could not receive approval to 
transfer funds to DCAA from another fund if it had a separate budget For 
example, providing DCAA with funds from the Defense Acquisition 
Workforce Development Fund constitutes a transfer (not a 
reprogramming), the authority for which is provided in the legislation 
governing the Fund, 10 U.S.C. § 1705(e). DOD also opposed mandatory 
public reporting by DCAA. We believe that periodic reporting to Congress 
and the public on the results of DCAA's work will enhance accountability 
over DCAA As discussed in our report, DCAA needs time to address the 
fundamental weaknesses in mission and the overall management 
environment However, if DCAA is not successful in resolving these 
problems under its current organizational placement, it will be necessary 
to consider additional actions. In this regard, it may be worthwhile to 
consider elevating DCAA as a component agency reporting to the Deputy 
Secretary because this could enhance DCAA's independence by providing 
it more authority within DOD and increase DCAA's visibility both within 
and outside of IK)D. 

DOD partially concurred with our recommendation that DCAA consult 
with DOD stakeholders and engage outside experts to develop a risk- 
based contract audit approach that identifies resource requirements and 
focuses on performing quality audits that meet GAGAS. DOD stated that 
DCAA already has a risk-based contract audit approach in identifying 
resource requirements and considers audit risk in planning various 
assignments. DOD st^d that DCAA will coordinate with the Under 
Secretary of Defense for Acquisition, Technology, and Logistics (USD 
(AT&L)) to assess DCAA audit requirements. DOD also noted that one of 
DCAA’s cultural transformation projects is identifying and resolving 


The USD(AT&L) is responsible under 10 U.S.C. § 133 for establishing DOD policies 
related to the negotiation, award, and administration of contracts, sxich as those related to 
the use of contract audit services, and for coordinating contract audit activities within 
DOD, 
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differing stakeholder expectations while ensuring DCAA perfonns quality 
audits that meet GAGAS. DOD expects to complete its assessment of 
stakeholder needs based on regulatory and statutory requirements by 
December 2010. We appreciate these steps; however, we remain 
concerned that DCAA's current approach of performing 30,000 to 35,000 
audits and issuing over 22,000 audit reports with 3,600 auditors 
substantially contributed to the widespread audit quality problems we 
identified. Generating that many reports and doing that many audits with 
3,600 auditors leaves very little time to perform in-depth, complex audits 
of contractors. While the Director of Defense Procurement and Acquisition 
Policy commented that contract audits need to be completed “in time to be 
useful,” to assure timely, quality audits, DCAA will need a risk-based 
approach to determine the appropriate level of audit and nonaudit effort 
and stafnng. 

DOD did not concur on our recommendation to develop policies and 
procedures related to direct-billing decisions, stating that (1) the 
department believes that a review of the contractor's interim public 
vouchers is an Integral function of DCAA’s continual assessment of a 
contractor’s billing system (2) DCAA is in the best position to review and 
approve contract interim billings based on its thorough understanding of 
the contractor's system, (3) DOD believes that our concerns are mitigated 
based on the comprehensive supervisory and audit manager reviews, and 
(4) DCAA does not believe that the approval of interim vouchers along 
with the approval for contractors to be on direct billing results in a lack of 
auditor objectivily. 

We continue to believe that DCAA’s management (nonaudit) responsibility 
to perform prepayment reviews of contractor vouchers for DOD and the 
auditor’s decision making role of approving contractors for direct billing 
privileges based on its audit conclusions about the strength of the 
contractor’s astern of internal controls, create audit objectivity issues. We 
revised our findings discussion and our recommendation to clarify this 
point. Under normal circumstances, DCAA must review contractor 
vouchers prior to payment — a management support function for DOD 
generally performed by DCAA field office administrative staff. By 
obtaining direct billing privileges, contractors can receive payment for 
goods and services without a voucher review by DCAA prior to payment. 
Because we found that this situation provides an incentive for DCAA to 
reduce its administrative workload by recommending that contractors are 
placed on direct billing, we recommended that DCAA develop new policies 
and procedures to ensure a separation between staff reviewing vouchers 
and staff making direct-bill decisions. In addition, DCAA has not explained 
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the basis for its belief that administrative staff have a thorough 
understanding of the contractois’ systems. Further, we disagree with 
DOD’s statement that our concerns are mitigated based on the 
comprehensive supervisory and audit manager reviews because this is not 
supported by our findings. The fact that DCAA approvals of contractor 
direct-bill privileges were not based on sufficient audit procedures as 
demonstrated by our work and DCAA's removal of over 200 contractors 
from the direct-bill program since our July 2008 report’* support our 
concern that the existence of such an incentive presents an objectivity 
impairment. 

DOD provided additional comments on findings in its transmittal letter. 
DOD stated that it disagrees with the suggestion in our report that the 
department has not yet begun to address the weaknesses we identified. 
Our report neither states nor implies that DOD has not yet begun to take 
action. In fact, one of our objectives was to analyze steps DOD has taken 
so far, and our report describes in detail the progress made. Oiu’ report 
acknowledges that several positive steps have been taken by DCAA, but 
much more needs to be done to address the fundamental problems. Thus, 
solutions to the problems documented in this report will take time to first 
implement and then will have to be independently assessed to make sure 
they are effective. Our report also notes that fundamental changes have 
not taken place. For example, to date DOD has not revised DCAA's 
mission statement to reflect the need to consider the pubUc interest as a 
key component of its work. In addition, DCAA has yet to assess the 
feasibility of 3,600 auditors issuing over 20,000 reports in one year (22,349 
in fiscal year 2008) and the appropriateness and need for the current 
combination of audit and non-audit services that drives this workload. 
Until these and other key steps are further along, it will be too early to 
assess whether DCAA has fundamentally changed or whether past 
practices continue. 

The DOD comments noted that one of our m^or findings is the lack of 
sufficient testing to support conclusions when giving an opinion on 
contractor internal control systems. The comments incorrectly refer to the 
requirement for sufficient testing as a GAO requirement and state that 
planned staffing increases may not be enough to accomplish audits 
required by regulation in light of additional testing stipulated by GAO. 
Professional audit standards have always required auditors to obtain 
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sufficient evidence to provide a reasonable basis for the conclusion 
expressed in the report As stated in our report, testing methodologies are 
a matter of professional judgment and can involve many factors. However, 
our fmdings reflect more than a difference of opinion with DCAA auditors 
on their exercise of professional judgment as reflected, in part, by the 
number of audit reports DCAA rescinded for insufficient testing. For 
example, we found insufficient documentation to support the 
methodology chosen and insufficient reasons for minimal testing, such as 
being told by a DCAA auditor that a “file size was too large" to test more 
than two recent vouchers. Again, DOD must address the feasibility of 3,600 
auditors issuing over 22,000 reports annually, most of which were 
reportedly performed under auditing standards. This may entail not only a 
risk-based audit 24 )proach but also exploring changes to the regulations 
that DOD represents require tens of thousands of these audits. 

DOD also disagreed with our position on the status of actions to 
strengthen DCAA’s quality assurance program. DOD stated that DCAA has 
been proactive in standing up its new Integrity and Quality Assurance 
Directorate. DOD also stated that it believes the extensive overhaul of the 
quality assurance function accomplished in fiscal year 2009 will mitigate 
the prior shortcomings in audit quality that we cited. Although DOD’s 
comments imply that DCAA has resolved its quality assurance problems, 
DCAA has acknowledged that it is not ready to undergo another peer 
review at this time. On September 1 , 2009, we received a letter fiom the 
DCAA Director, stating that although improvements were put in place in 
fiscal year 2009, several significant improvements will be accomplished in 
fiscal year 2010. To allow sufficient time for DCAA to fully implement the 
necessary corrective actions, DCAA contacted us for guidance on (1) 
deferring its external quality control review for 2 years and (2) requesting 
that the next external peer review to cover assignments to be completed in 
fiscal year 2011. We agree with DCAA that it is not cost-effective to 
undergo an external peer review until an adequate system of quality 
control is in place. Expending substantial DOD IG resources when DCAA 
acknowledges that several years are necessary for improvements to be 
fully implemented is, in our view, an inefficient use of resources. DCAA 
has already begun to appropriately disclose in its reports that its audits do 
not comply with GAGAS external peer review requirements. 

The Director of Defense Procurement and Acquisition Policy (DPAP) 
provided additional comments. The Director stated that our report 
impugns DCAA’s audits and that we adopt the ix)sition that because DCAA 
is serving the interests of contracting officers, DCAA is therefore not 
auditing in the interest of the public. The Director further asserts that 
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DCAA serves the public interest by providing useful and timely 
information to contacting officers, and that it is erroneous to imply that 
contracting officers do not seek to protect the public interest. Also, the 
Director states that GAO agrees with the Defense Business Board’s 
recommendation to revise DCAA’s mission to reflect a focus on the 
taxp^er as the primary customer. Finally, the Director suggests that our 
criticism of DCAA’s “production-oriented auditing" sets up a dichotomy 
between quality and timely audits. We disagree with these 
characterizations of our report. 

DPAP’s statements that our report impugns DCAA’s audits and that we 
take the position that when DCAA is serving the interests of contracting 
officers, it is not auditing in the interest of the public relate to our 
summarization of the Defense Business Board (DBB) report and not our 
findings. Our report does not endorse the specific recommendations of the 
DBB to focus on the taxpayer as the primary customer. As our report 
points out, this recommendation does not take into account the regulatory 
and policy requirements that establish DCAA's primary role as an advisor 
to government contracting officers and disbursing officers. However, we 
agree with the DBB that DCAA should consider the public interest when 
carrying out GAGAS engagements. For audits and attestation engagements 
conducted under GAGAS, the auditor is expected to objectively and 
independently acquire and evaluate sufficient, appropriate evidence, and 
report on the results, consistent with the guidance in GAGAS. GAGAS 
states the principle that “observing integrity, objectivity, and 
independence in discharging (auditors’) professional responsibilities 
assists auditors in meeting the principle of serving the public interest and 
honoring the public trust."*'* 

DPAP also stated that the contracting officer is bound by regulation to 
meet the public interest in the broadest sense, for the entire matter 
surrounding a contract and that this includes factors other than DCAA 
audit findings and recommendations. As reflected in the extensive 
background discussion and elsewhere throughout our report, we 
recognize that contracting officers make final contracting decisions, and 
DCAA engagements support contracting officers in that process. Because 
we did not review the standards that contracting officers must follow, we 
did not include references to the requirements for contracting officers to 


See GAO-()7-7:iIG, § 1.03. 
GAa()7-731G, § 2.06. 
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protect the public interest in their sictions. Our report also states that 
DCAA contract audit services are intended to be a key control to help 
assure that prices paid by the government for needed goods and services 
are fzur and reasonable and that contractors are charging the government 
in accordance with applicable laws, regulations (e.g., Federal Acquisition 
Regulation (FAR) and Defense Federal Acquisition Supplement (DFARS), 
standards (e.g., Cost Accounting Standards (CAS)), and contract terms. In 
providing this assurance, DCAA audits would necessarily take into 
account serving the public interest. However, when DCAA audits do not 
meet GAGAS, they do not provide this assurance and thus are not serving 
the public interest We found that DCAA auditors lacked objectivity and 
independence when performing GAGAS audits and engagements. In many 
cases, this was a result of auditors’ focus on expediency to support client 
needs and, as the Director also observes, human capital shortages and 
poor management decisions. We do not question the need for contracting 
ofTiceis to use the services of advocates and assistants in cariying out 
their duties. However, when contract auditors represent that they are 
performing engagements under GAGAS, their primary focus should be on 
the integrity, objectivity, and independence of their work, which serves 
both contracting officers and the public interest. Further, the quality of 
DCAA audits impacts the quality of information available for contracting 
officer decisions. Whether DCAA can adhere to GAGAS on contract audits 
that provide minimal time to perform the work Is a factor that USD 
(AT&L) should consider when establishing requirements for contract audit 
services. As we recommended, DOD should reconsider the mix of audit 
and non-audit services that it needs. 


DOD IG Comments and The DOD IG concurred with our recommendation to reconsider its overall 
Our Response conclusions in the May 2007 report on the audit of DCAA’s quality control 

system in which it reported an adequate (“clean”) opinion on DCAA’s 
system of quality control in light of the serious deficiencies and findings 
included in that report and the additional evidence identified in our audit. 
The IG also stated that it did not concur with our recommendation to 
rescind the report and, because of that statement, we believe the IG 
misconstrued our recommendation as expressly calling for a rescission or 
modification of its peer review report. Our recommendation was for the IG 
to determine, based on the results of our recommended reconsideration of 
the IG’s conclusions, whether it should rescind or modify the peer review 
report. 

The DOD IG also states that it took alternative action that conformed to 
the intent of our recommendation. The DOD IG comments state that it 


Pi^e 80 


GAO'09'468 DCAA Audit Environment 


VerDate Nov 24 2008 


13:37 Apr 18, 2011 Jkt 053841 


PO 00000 Frm 00222 Fmt6601 Sfmt 6601 


P:\DOCS\53841.TXT SAFFAIRS PsN: PAT 



219 


notified DCAA on August 24, 2009, that the May 2007 “adequate” opinion 
on DCAA’s system of quality control would expire on August 26, 2009. In 
addition, the IG stated, “We have determined that it is not prudent to allow 
the adequate opinion from our May 2007 report to carry forward.” 
However, peer review opmions neither “expire” nor “carry forward" 
beyond the period covered by the peer review. Peer review opinions cover 
the period to which the opinion applied — in DCAA’s case, as of the end of 
fiscal year 2006 — ^and the peer reviewed audit orgaiuzation need not 
undergo another peer review during the next 2 years. Because it has 
been more than 3 years since DCAA’s last peer review, DCAA is no longer 
in compliance with the GAGAS requirement for an external peer review, 
and DCAA has taken appropriate action to disclose this noncompliance in 
its reports. 

As stated in our report, die overall conclusion in the DOD IG report is 
inconsistent with the detailed observations in its report, which indicate 
numerous significant deficiencies in DCAA’s system of quality control. 
Further, based on DCAA's actions to rescind 80 audit reports, 39 of which 
were issued in fiscal year 2006— the period on which the IG conclusions 
are based — and the findings in our audit, we concluded that DCAA’s 
quality control system for the period covered by the DOD IG peer review 
was not effectively designed and implemented to provide assurance that 
DCAA and its personnel comply with professional standards. 


As agreed with your office, unless you publicly announce the contents of 
this report, we plan no fiirther distribution for 30 days from the report 
date. At that time, we will send copies of this report to the Secretary of 
Defense; the Under Secretary of Defense (Comptroller/CFO); the Under 
Secretary of Defense for Acquisition, Technology, and Logistics; the DOD 
Director for Defense Procurement and Acquisition Policy; the Deputy 
General Counsel for Acquisition; the Secretary of the Army; the Secretary 
of the Navy; the Secretary of the Air Force; the Director of DCAA, the 
Director of DCMA; the DOD Inspector General; and the Director of the 
Office of Management and Budget. In addition, this report will be available 
at no charge on the GAO Web site at ht^://www.gao.gov. Contact points 
for our Offices of Congressional Relations and Public Affairs may be found 
on the last p^e of this report. 


G.\0-«7-7,ilG. § 3.55. 
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If you or your staff have any questions concerning this report, please 
contact me at (202) 512-7922 or kutzg@gao.gov or Gayle Fischer, Assistant 
Director, Financial Management and Assurance at (202) 512-9577 or 
rischerg@gao.gov. 



Gregory D. Kutz 
Managing Director 

Forensic Audits and Special Investigations 


Pag« 62 


GAO-09-468 DCAA Audit Environment 


VerDate Nov 24 2008 


13:37 Apr 18, 2011 Jkt 053841 


PO 00000 Frm 00224 Fmt6601 Sfmt 6601 


P:\DOCS\53841.TXT SAFFAIRS 


PsN: PAT 



221 


VerDate Nov 24 2008 


Appendix I: Internal Control System Audits 
Did Not Meet Professional Standards 


In performing its audits, the Defense Contract Audit Agency (DCAA) states 
that it follows generally accepted government auditing standards 
(GAGAS) ‘ As part of our assessment of DCAA’s overall management 
environment and quality assurance structure, we reviewed documentation 
for selected DCAA suidits of contractor systems controls for compliance 
with GAGAS. We focused on internal control audits because contracting 
officers rely on DCAA audit opinions on contractor system controls for 3 
or more years to make decisions on pricing and contract awards and 
DCAA uses the audit opinions to assess risk when planning subsequent 
audits. We selected seven DCAA field audit offices (FAO) across the five 
DCAA regions that reported predominately adequate (“clean”) opinions on 
contractor controls. For the seven FAOs, we reviewed 37^ selected audits 
of contractor internal control systems, including accounting, estimating, 
billing, and indirect and other direct cost systems. As shown in table 5, we 
assessed these audits for compliance with eight key areas of GAGAS 
requirements: (1) auditor independence;’ (2) adequate planning; (3) 
auditor understanding of controls; (4) design of procedures to detect risk 
of fraud, abuse, mismanagement, and contract terms; (5) documentation 
of sampling and testing; (6) audit evidence supports conclusions and 
opinion; (7) proper supervision; and (8) timely reporting and disclosures.’ 
We also considered GAGAS requirements for protecting the public interest 
when using auditor judgment.® As discussed in the body of this report, the 
37 audits we reviewed ^d not comply with GAGAS in one or more of these 
areas. However, we determined that 4 of the 37 audits included sufficient 
testing to support reported conclusions and opinions. Because the 
conclusions and opinions in the deficient audits were used to make risk 
assessments and determine the level of testing in other DCAA audits, such 
as annual audits of contract or incurred cost claims, audits of contract 
proposals and contractor forward pricing proposals, progress pay audits, 
and contract close-out audits, the audit quality Issues related to the 


’ CAM 2.10i(a) and 2-I03c(J). 

’ We originally selected 39 internal control audits for our review. Because two audit 
assignments were performed as assist audits to an internal control audit in our selection, 
we considered these three assignments as one audit, and therefore, we reviewed a total of 
37 audits of contractor system internal control audits. 

’ GAC)-n3-673G, Ch^terS, especially §§ 3.03, 3.04, and 3.13-3.17, 

* GAGAS for attestations audits related to requirements 2 through 8 are covered in 
<; AO-03-r>73G, |§ 6.04a; 6. 13^. 14; 6.24a & c; 6. 15a. and 6. 16^.20; 6.02a, 6.(Hb, 6.22<and 6.24; 
and 6.28-6.54. 

® GAOm^iTMi, § 3.33^.38. 
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Appendix I: Internal Control System Audits 
Did Not Meet Profession^ Standards 


GAGAS noncompliance we identified potentially impacts hundreds of 
other audits and contracting decisions covering billions of dollars in DOD 
ejqienditures. 


Table 5: GAGAS Noncompliance on 37 Selected Audits of Contractor Controls 


DCAA regions 


Reasons for GAGAS noncompfiance 

Northeast 
(FAO #1) 

Mid-Atlantic 
(FAO #2) 

Eastern Central 

(FAO«3) (FAO #4 & 5) 

Western 
(FAOs #6 & 7) 

Alt 

regions 

Independence impairments 

0 

0 

1 

2 

4 

7 

Inadequate planning 

0 

4 

1 

5 

7 

17 

inadequate auditor understanding of controls 

1 

4 

0 

2 

5 

12 

Lack of fraud risk detection procedures 

4 

5 

6 

11 

9 

35 

Insufficient documentation on sampling 
methodology 

3 

5 

6 

9 

4 

27 

Insufficient evidence to support cortckisions and 
opinion 

3 

5 

6 

11 

8 

33 

Improper Supervision 

0 

0 

2 

5 

6 

13 

Repiorting problems 

4 

5 

6 

12 

10 

37 

Total GAGAS noncompliance issues 

15 

28 

28 

57 

53 

181 

Number of audits 

4 

5 

6 

12 

10 

37 

Rescinded reports 

1 

3 

3 

7 

4 

18 

S<Mc« : GAO ol »«iecie4 OCAA 3u«ts. 


Note: Because of the large size of the Central and Western regions, we tested audits at more than 
one Tteld audit office in these regions. 

The following discussion includes examples of GAGAS noncompliance 
from specific audits we reviewed. 


Independence gagas state that the audit organization and the individual auditor should 

Impairments ^ appearance, from personal, external, and 

organizational impairments to independence.® Our review of 37 audits of 
contractor internal controls found evidence in documentation for 7 audits 
that DCAA independence was compromised because auditors provided 
material nonaudit services to a contractor they later audited; experienced 
access-to-records problems that were not resolved; delayed report 
issuance, which allowed the contractor to resolve cited deficiencies, 


* GA0-03-(57:}G, § 3.03, and G.\a07-73IG. § 3.02. 
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Appendix I: Internal Control System Audits 
Did Not Meet Professional Standards 


without proper reporting; and performed test work on billings the 
contractor selected for testing. GAGAS state that auditors should be free 
from influences that restrict access to records or improperly modify audit 
scope.^ GAGAS also state that audit organizations should not audit their 
own work or provide nonaudit services if the services are sigiuficant or 
material to the subject m^er of the audit.^ The following ex^ples 
describe a situation where auditors assisted a Department of Defense 
(DOD) contractor in developing billing system policies and procedures 
after identifying five sigiuficant deficiencies and then reviewed their own 
work during a follow-up audit. 


OCAA Auditors Issued an Adequate Opinion on Controls They Helped Design 

DCAA auditors impaired their independence by performing nonaudit services for one of 
the top five DOD contractors in terms of dollars when they helped the contractor develop 
policies and procedures that were material to the billing system they were auditing. 

On May 12, 2005, OCAA reported an inadequate-in-part opinion on the contractor's 
billing system internal controls. The report included five significant deficiencies, including 
a failure to maintain current, adequate billing system policies and procedures. After 
issuing the report, OCAA auditors helped the contractor develop adequate policies and 
procedures related to accounts receivable, overpayments, and monkoring of the billing 
system before performing Uie required follow-up audit— an impairment to auditor 
independence. A year later, after performing the follow-up audit, OCAA auditors 
concluded that the contracted had performed adequate actions to correct alt of the billing 
system deficiencies (deviously reponed. On June 28, 2C)06, DCAA reported an adequate 
opinion on the contractor's billing system internal controls. 

Following GAO's review of these audits, on March 6. 2009, DCAA rescinded the billing 
system audit follow-up report. 


We also noted instances of denials and limitations on access to records by 
contractors that were not handled properly. For example, during a billing 
system audit of one of the top five DOD contractors, an e-mail message 
documented in (he audit workpapers showed that the auditors were 
challenged by a contractor official when they requested documentation to 
test whether billing clerks had received required training. The contractor's 
e-mail stated, “Here’s a question for you. Can you tell me who and what 
requirement is making this part of the (audit]. This is a question that [is] 
being asked by (the Cash Manager].” The auditors eventually obtained 
limited training documentation from the contractor. Audit documentation 
£ind our interviews with the auditors revealed that the auditors also limited 


^ See <;;AO-Oa-6?3G, 5 3.19 and GAO-07-731Ci, § 3. 10. 


GAO-0:l-G73G, §3.16. 
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testing in several other areas “because the contractor would not 
appreciate it.” Access to records problems and strong external influence to 
limit testing are both impairments to independence according to GAGAS.® 


Inadequate Planning gagas for attestation engagements state that the work shall be 

adequately planned.'® Auditors should communicate information regarding 
the nature, timing, and extent of planned testing and reporting to officials 
of the audited entity and to the individuals contracting for or requesting 
the attestation engagement. Auditors should also plan work to follow up 
on actions to address significant findings and recommendations in 
previous audits and assess areas of risk in planning the engagement. 
However, our review of the audit documentation determined that 17 of the 
37 internal control audits we reviewed were not adequately planned. 

• In five audits, auditors failed to consider risk associated with new 
systems that had not yet been audited or systems that had not been 
audited in more than 4 years. These audits should have been ascribed a 
higher risk level according to DCAA CAM guidance and testing should 
have been increased." DCAA has rescinded three of the five audits and 
is planning new audits, as appropriate. 

• Without documenting the basis for their decisions, auditors deleted 
audit steps from standard audit programs or did not perform all audit 
steps for three of seven audits we reviewed at one FAO. When we 
asked the auditors why they omitted key audit procedures in their 
work, the auditors told us they used “auditor judgment.” However, the 
auditors would not explain the basis for their judgments to us or their 
rationale for omitting key procedures, such as assessing the 
contractor’s control environment and testing the implementation of a 
contractor’s policies and procedures. Because we did not find any 
justification for omitting key audit procedures in these three audits, we 
determined that they were inadequately planned. 

The following case discussion illustrates deficiencies in audit planning as 
well as a lack of auditor understanding of contractor processes and 
controls. 


® See GAO-0:i4l73G, § 3.19, and GAO-07-7aiG, § 3.10. 

GA04Ki-673G, §§ 6.(Ma. 6.06. and 6. 1 1. 

"CAM 5-103. 
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Did Not Meet Professional Standards 


DCAA Erroneously Peifonned an Audit over a Billing System That Did Not Exist 

In 2004. a Western Regicxi FAO planned a billing system audit of a federally funded 
research and development center (grantee) that receives $1 .5 billion annually for 
research services. However, the planning for this billing system audit did not take into 
account the fact that grantees are funded through letters of credit and do not actually 
bill the government. This financial relationship is very different— and much less 
complicated — than a situation where a contractor bills the government for contract costs 
in accordance with Cost Accounting Standards and the Federal Acquisition Regulation. 
For examine, under a letter of credit financing arrangement, grantees draw funds as 
disbursements are made and are required to prepare reports of transactions on their 
use of the funds and submk them to the funding agency. Despite this obvious mistake, 
on May 6. 2005, DCAA auditors issued a report staling that the grantee had an 
"adequate billing ^tem.’ 

Another report issued by the same DCAA office on June 25, 2(X>4. reviewed the 
grantee's cash management practices under the Single Audit Act for another federal 
ager>cy. The audkors could have simply forwarded this report to the DOD contracting 
officer — a task that virould take an hour at the most to complete. Instead, DCAA auditors 
charged ovet 530 staff hours to generate documentation to meet DCAA's billing system 
audit requirements, even though there was no related "billing system." As a result of our 
review, DCAA reassessed the need to perform a billing system audit for the grantee 
and determined that it would rely on the Single Audit Act reports in the future. DCAA 
has not rescinded the audit repon even though it expresses an opinion on a nonexistent 
system. 


Auditors Did Not Properly 
Document Understanding 
of Controls for Several 
Audits 


GAGAS require that in planning examination-level attestation 
engagements, auditors should obtain a suificient understanding of internal 
control that is material to the subject matter and design procedures to 
achieve the objectives of the audit. The subject matter or assertion the 
auditor is testing may relate to the effectiveness and efficiency of 
operations, including the use of an entity’s resources; the reliability of 
financial reporting, including reports on budget execution and other 
reports for internal and external use; compliance with applicable laws and 
regulations, provisions of contract, or grant agreements; and safeguarding 
of assets.'® Although most of the 37 internal control audits we reviewed 
met this standard, 12 audits did not. The foUowing case study shows an 
example of insufficient understanding of controls. 


On five audits, auditors overstated the strength of the contractor’s 
control environment in the audit documentation and used this 
information to justify performing little or no testing of controls for 


§§6.13^.14. 

'® GA(>-(X^-673C1, §§6.13 and 6.14. 
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accounting and billing system control audits. On two of the five audits, 
a Mid-Atlantic Region auditor admitted that he included inaccurate 
statements in the audit documentation. These statements indicated 
that the contractor performed internal audits and had a formal 
management-level monitoring process over accounting and billing 
functions. When we requested copies of the internal audits and 
management reviews, the auditor admitted that these statements were 
not true and that he had made “mistakes.” He entered the factually 
Incorrect information in the audit documentation to justify performing 
little or no testing. The auditor was a GS-13 technical specialist who 
reviewed the work of other auditors and provided them audit guidance. 
DCAA has rescinded four of the five audits and is planning or initiating 
new audits. 

• On another audit involving a business segment of a third contractor of 
the top 5 DOD contractors, auditors did not consider the contractor’s 
control environment in planning an audit of a new accounting 
system — a significant factor that resulted in insufficient testing. 
Further, after identifying significant accounting system deficiencies, 
including that certain contract costs are manually processed, are not 
processed timely, or are not adequately reconciled to actual incurred 
costs, the auditors delayed issuance of the audit report for about 16 
months, wailing to see if the contractor would take corrective actions 
on the identified deficiencies. Although test procedures were applied 
from February 25, 2004, to September 15, 2004, DCAA reported an 
"inadequate-in-part” opinion on the contractor’s accounting system on 
March 14, 2006— nearly 1-1/2 years later, without performing any 
additional testing. Following discussions with GAO, DCAA rescinded 
this audit report on November 20, 2008. 

In the audit described below, the auditor relied on the contractor to 

document the auditor’s understanding of controls. 
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DCAA Auditors Relied on the Contractor to Document Internal Controls without 
Testing the Accuracy of the Documentation 

This case involves a billing system audit DCAA conducted in 2006. The last time DCAA 
had tested the billing system for this contractor was in 20(X)— a clear indication that new 
tests should be performed. At ttiat time, DCAA's CAM required that contractor internal 
control sy^ems be audited every 2 to 4 years. However, rather than re-testing the 
billing system, DCAA auditors provided the contractor's Information Systems Manager 
with 6-year-old documentation obtained diring a DCAA auditor's walkthrough of the 
billing process in the prior audit. The DCAA auditors asked the Information Systems 
Manager to update the documentation by making edits where necessary. According to 
the audit wori^ap^s, the 6-year-old documentation was "edited by the contractor" and 
provided back to the DCAA auditor. Based on the contractor's documentation of the 
billing system internal controls, the auditor concluded ^we can limit our testing of 
management reviews, policies artd procedures, and implementation of policies and 
procedures." The auditor then traced one paid voucher through the billing process. This 
procedure relates to determining whether the auditor's understanding of the process is 
correct and is nrH substantive testing (i.e., detailed tests of transactions and balances 
and analytical review (xocedires.} 

The auditor told GAO that she used this "low-risk approach" because she felt that the 
contractor's system was "strong" and did not warrant a higher risk approach. However, 
according to the documentation GAO reviewed, the billing system was a soUware 
package that downloads accounting system data to spreadsheets. Manual calculations 
were then used to develop invoice amounts— -a process that is prone to errors and does 
not provide assurance of consistent systematic processing of invoices. Further, since 
DCAA's earlier walkthrough in 2000, the contractor had experienced significant 
downsizing and restructuring. 

The auditor performed no testing of the contractor's billing system controls in order to 
determine whether the system was operating effectively at the time of the audit. The 
audit report that was issued on June 21 . 2006. with an adequate opinion was not based 
on sufficient audit procedures to provide assurance over approximately $76 million in 
sales to the government. After GAO raised concerns about this audit, DCAA rescinded 
the audit report on March 3. 200d. 


Failure to Design and For DCAA examination-level attestation audita of contractor controls that 

Perform Procedures to reviewed, GAGAS requires auditors to design and perform audit steps 

Detect Fraud Risk ^ obtain reasonable assurance of detecting fraud, illegal acts, or 

violations of provisions of contracts that could have a material effect on 
the subject matter of the engagement or internal control.'^ DCAA 
management asserts that its examination-level audits are designed to 
provide this assurance, and DCAA internal guidance requires auditors to 
consider a list of fraud indicators included in DCAA’s CAM or the DOD 


'* GAO-0:1-fi7;?G, §6. 15a. 
CAM, Figure 4-7-3. 


Page 89 


GAO-09-468 DCAA Audit EnTironinent 


VerDate Nov 24 2008 


13:37 Apr 18, 2011 Jkt 053841 


PO 00000 Frm 00231 


Fmteeoi sfmteeoi 


P:\DOCS\53841.TXT SAFFAIRS PsN: PAT 



228 


Appendix I: interml Ccmtrol System Audits 
Did Not Meet Profe^onai Standards 


Inspector General’s Handbook on Fraud Indicators'® in planning and 
performing their work. However, for 35 of the 37 internal control audits 
we reviewed there was no evidence that DCAA auditors designed specific 
procedures to identify risk of fraud, illegal acts, violations of contract 
terms, or other improprieties. Further, our analysis of audit workpapers 
showed that DCAA auditors lacked an understanding of fraud indicators 
associated with weak internal controls. For example, although segregation 
of duties is a key fraud-prevention control, in the seven audits where 
workpapers identified segregation of duties issues, the auditors did not 
consider a lack of segregation of duties to be a fraud risk in 6 of the audits. 
The auditors did not look for a compensating control or perform 
additional procedures to determine whether the lack of segregation of 
duties had allowed fraud to occur. Occurrences of duplicate invoices also 
would increase the risk of fraud. However, DCAA's audit program for 
testing contractor billing system controls does not include specific 
procedures to test for duplicate contractor invoices. We found evidence of 
testing related to duplicate invoices in only 2 of the 37 internal control 
audits we reviewed. Moreover, in the audit described below, DCAA FAO 
mans^ers ordered an auditor to ignore significant fraud risks during an 
audit. 


OCAA FAQ and Region Management Prevented an Auditor from Pursuing 
Significant Fraud Risks during a Billing System Audit 
During a fiscal year 2003 incurred cost audit of a major defense contractor, a DCAA 
Central Region auditor learned of a fraud investigation initiated by the Army's Criminal 
Investigative Division (CID) in response to allegations of contractor fraud reported in 
August 2002. In July 2004, during a billing system audit of the same contractor, the 
auditor contacted the Army CID investigator to discuss the ongoing fraud investigation 
and learned that the fraud related to improper billings. As a result of this elevated fraud 
risk, the auditor requested several nominal increases in budget hours to perform 
additional testing to determine the extent of the fraud. The auditor had prior DOD 
contract administration experience and intended to use this experience in applying her 
audit testing procedures. After approving increases in budgeted hours for this 
assignment, the regional audit manager told the auditor that her concerns were not 
valid and to remove her "contracting hat." 

Eight months later, on April 26, 2005. the auditor submitted a draft audit report to her 
supervisor. She concluded that the contractor's billing system was inadequate— a 
finding that would have resulted in the contractor losing its direct-billing privileges, The 
auditor noted several deficiencies and concerns, including (1) the lack of billing policies 
and procedures. (2) a lack of training for contractor employees responsible for 
preparing invoices, (3) indicaUons that the contractor may have billed the government 
for unapproved and unftjnded work, and (4) evidence of an ongoing criminal 


‘® DOD Inspector General, Handbook on Fraud Indicators for Contract Auditors, Section 
n.4 (IGDH 7600.3 APO, March 31. 1993). 
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invesllgalion by the /^my CIO, After reviewing the report, the supervisor and FAO 
manager directed the auditor to change the opinion from inadequate to inadequate-in- 
part because the auditor had not identiried any excess or unatiowable costs. The audit 
report, issued on August 31, 2005, reported an inadequate-in-part opinion and 
combined the first two deTicienctes, reporting a total of three significant deficiencies. 
However, DCAA did not remove the contractor from the direct-bill program, whereby 
contractors are authorized to submit invoices directly to a government paying office 
without prior review. 

The auditor assigned to the original audit was also assigned to the billing system follow- 
up audit, but she was subsequently removed from the fdtow-up audit because, 
accr^ding to her supervisor, she was documenting her audit in too much detail, in 
January 2006, during the follow-up audit. Army CID concluded its fraud investigation. 
The contracting officer’s technical representative (COTR) and several contractor 
employees were convided of fraudulently billing the government using the billing 
system that DCAA later deemed adequate. The investigation found that the COTR and 
the contractor employees were charging the government for travel to contract-related 
conferences and arranging the trips so they could attend a NASCAR race at 
government expense. They look government cars on the trips and various contractor 
employees each charged the government for use of their personal cars, with the COTR 
approving the travel vouchers. In addition, the COTR had contractor employees cut 
scrap lumber on government land and slack it at his home for use as firewood. The 
government was billed for the contractor employees' time on behalf of the COTR. in the 
January 2006 settlement, which totaled over $2.8 million, the COTR and contractor 
employees paid fines and restitution, and the COTR also served jail time. 

The Army CID Special Agent in charge of the fraud investigation told us that he had 
tried on numerous occasions to get ihe DCAA FAO manager to stop issuing incurred 
cost audit reports with "clean* opinions because the opinions would be contradicted by 
the findings in the ongcNng fraud investigation. The FAO issued Ihe 2002 incurred cost 
audit report on January S, 2005, stating its opinion that except for the qualification that 
the ongoing fraud investigation had developed information which may impact the costs 
and transactions in this report, the claimed direct costs are acceptable and are 
provisionally approved, pending final acceptance DCAA did not include a cautionary 
note or similar qualification in the billing system audit report. In September 2006, DCAA 
reported an adequate ("clean’} opinion in the follow-up audit report on the contractor's 
billing system controls without performing work to confirm that the contractor's billing 
system policies and procedures were effectively implemented. 

Following GAO'S review of these audits, on November 20. 2006. DCAA rescinded both 
reports because the audit documentation did not support the reported opinions and 
initiated a new audit of the contractor's billing system controls. 


Insufficient 
Documentation of 
Sampling and Testing 
Methodology 


Testing is a critical auditing procedure that allows auditors to determine 
whether controls are operating effectively. Although some testing can 
involve statistical samples, such samples are not required under GAGAS. 
Instead, GAGAS require that auditors prepare attest documentation in 
sufficient detail to enable an experienced auditor, having no previous 
connection to the audit, to ascertain from the attest documentation that 
the evidence supports the auditors’ significant judgments and conclusions. 
Under GAGAS, attest documentation should contain the objectives, scope, 
and methodology of the attestation engagement, including any sampling 
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and other selection criteria used.” Of the 37 internal control audits we 
reviewed, 27 audits did not contain workp^er documentation to 
demonstrate that the auditors’ nonstatistical samples met these 
requirements, for example: 

• On one billing system audit, the auditor performed testing on two 
vouchers. TUe auditor did not document how he selected the two 
vouchers, and he did not document the population of contractor 
vouchers in the workp^ers or the basis for his judgment on selecting 
the two vouchers for testing. When we asked the auditor why he 
selected two most recent vouchers for testing and did not document 
the voucher population, the auditor told us it was because “the file size 
was too large,” and he saves the population hies on his desktop 
computer. 

• On a billing system audit of one of the five largest DOD contractors we 
asked the auditor why he tested only one voucher to assess the 
contractor’s controls for subcontractor accounting and billing. The 
auditor said this was reasonable because DCAA “had tested so many 
vouchers before." Other workpaper documentation noted testing was 
not performed on the direct-bill section of the audit program. When we 
asked the auditor why these procedures were not performed, the 
auditor told us that testing was performed by another FAO when the 
contractor implemented a new system 2 months earlier, and he decided 
not to do testing again because “the contractor would not appreciate 
it” — an indication of an auditor independence problem. Moreover, tests 
of new billing systems focus on data processing controls and would not 
take the place of tests of invoices for compliance with CAS, FAR, and 
contract terms. 

Although the CAM Includes guidance on sufTicient testing,*" auditors 
appeared to follow general guidance throughout the manual that advises 
auditors to use their judgment “to ‘test check’ a procedure, to make 
verifications ‘on a selective basis,’ or to review a ‘representative number’ 
of transactions or items." Several auditors, field office managers, and 
DCAA headquarters officials told us that they believed “spot checks” were 
sufficient testing to conclude on controls overall and they did not believe 
they were required to document their sampling plans. 


” t5AO-0;W573G, §§ 6.04b. 6.22, and 6.24a. 
'* CAM 4-600 and Appendix B. 
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DCAA Relied on Faulty Auditor Judgment to Approve Contractor Contois 

An Eastern Region auditor performed minimal testing in an audit of controls over 
indirect and other direct cost for a business segment of one of the top five DOD 
contractors that billed the government fcM* about $1 billion during 2006. The auditor did 
not use stati^ical sampling or test a representative selection of accounts payable 
transactions. Instead, without documenting the reasons for his Judgments, the auditor 
tested 6 15.000 accounts payable transactions ($86 of $50 million), 3 of 4,500 travel 

transactions ($2,700 of $15 million), and 3 of 1,600 interdivisional iransaciions ($5,000 
of $16 million). On September 27, 2006, DCAA reported an adequate opinion on the 
contractor’s controls over direct and Indirect costs. However our review of the audit 
workpapers revealed 

• no explanation of why so few transactions were tested. 

• no rabonale for why transactions selected for testing covered the months of May 
through July 2005, when transactions occurred throughout the year, or 

• how the auditor concluded that the system was adequate based on teeing 1 2 out 
of about 22,000 transactions. 

When we asked the auditors to explain the basis for their selection of transactions used 
for testing, FAO management said the selection was based on auditor judgment; 
implying auditors could use their professional judgment without the need to meet any 
specific criteria in doing so. GAGAS section 3.34 (GAO'03-673G) states that auditors 
should consider the need to protect the public interest when making professional 
judgments. GAGAS section 6.02a requires auditors to perform sufficient testing to 
support audit conclusions and opinions on controls. Determining what is sufficient 
testing requires auditors to determine an appropriate sample size considering risks, 
expectation of misstatements or deviations, and materiality, and select a representative 
sample from the poptrtaUon, meaning that all trartsaciions have a known chance of 
being selected. GAGAS section 6.24 a. and c. require auditors to document the 
sampling plan and auditor judgments made in sampling and testing. This audit did not 
meet these GAGAS requirements. 


Insufficisnt Evidence to We found that audit procedures for most of the 37 internal control audits 
Support Audit Conclusions reviewed documented the design of controls but did not test the 
and Opinions implementation of controls. As a result, the audits lacked sufficient 

evidence to support audit opinions that covered both the design and 
implementation of controls. GAGAS for examination-level attestation 
engagements require that sufficient evidence be obtained to provide a 
reasonable basis for the conclusion that is expressed in the report. 

GAGAS state that attest documentation serves to (1) provide the principal 
support for the auditor’s report, (2) aid auditors in conducting and 
supervising the attestation engagement, and (3) allow for the review of the 
quality of the attestation engagement The preparation of attest 
documentation should be appropriately detailed to provide a clear 


‘®GAa03-f>73G, §6.04b. 
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understanding of its purpose and source and the conclusions the auditors 
reached, and it should be appropriately organized to provide a clear link to 
the findings, conclusions, and recommendations contained in the auditors’ 
report.^ 

Overall, we found that 33 of the 37 internal control audits did not include 
sufficient testing of internal controls to support auditor conclusions and 
opinions. Our review of audit workpapers often found that only two, three, 
or sometimes five transactions were tested to support audit conclusions, 
for example: 

• On several audits, DCAA concluded that a contractor had adequate 
controls for removing system access for terminated or transferred 
employees. However, the auditors did not document the employee 
population from which individual employees were selected for testing 
system access, or the methodology used to select them. On none of 
these audits did we see evidence that DCAA auditors checked 
alphabetical listings of individuals having system access to lists of 
current personnel to confirm that access was removed when 
employees transferred or left the company. Without documentation of 
sampling and testing methodologies, liiere is no way to ascertain how 
the auditors came to their conclusions that controls were adequate or , 
that sufficient testing was done to support audit conclusions. 

• For many controls, DCAA did not perform any testing at all. For 
example, at least 6 of the 9 accounting audits we reviewed did not 
include procedures for testing contractor segregation of allowable and 
unallowable cost; 20 of 22 billing system audits we reviewed did not 
include tests to identify duplicate invoices, and 10 of the 22 billing 
system audits of contractors that relied on manual procedures to 
prepare invoices from accounting system data queries did not check 
for compensating controls. For one audit, DCAA issued an adequate 
opinion on the accounting system for a major DOD contractor after 
performing a walkthrough of the accounting process and interviewing 
two employees. 


“ GACW);?-f>73G, §6.24. 
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Adequate Opinion on Contractor Biiting System Was Based on Spot Checks of 4 
Vouchers Generated on the Same Day 

A Mid-Atlantic Reg'ion auditor used interviews with contractor staff and limited testing as 
evidence that billing system controls were adequate for a DOD contractor with about 
$40 million in annual government sales. Workpapers documenting audit procedures on 
key internal controls referred to "discussions with the contractof" rather than 
independerk auditor verification, including (1) verification of periodic reviews of 
contractor policies and procedures, (2) implementation and effectiveness of policies 
and (Kocedures. (3) frequency and sufficiency of the contractor's management reviews, 
(4) timely processing of offsets, and (5) exclusion of non-btliaWe items from government 
billings. Although the audit was performed from November 2004 through July 2005, 
according to the wixkpapers. the auditor tested a nonstatislicai selection of four 
vouchers (invoices) totaling $2.3 million that were all processed on the same day— 
February 28, 2005. The workpapers contained no documentation on the population of 
invoices or the basis for selecting four vouchers for testing that were all processed on 
the same day out of the 8-month period covered by the audit. GAO also determined 
that the auditors performed no testing of the contractor's billing system Information 
technology (electronic data processing) controls. As a result, this audit can not be relied 
on for assurance that the contractor's billing system and related internal control policies 
and procedures were adequate as of June 1 6, 2005. 


Audit Supervision gagas require that assistants (audit staff) be properly supervised and that 

Problems audit documentation contain evidence of supervisory reviews of the work 

performed that suppoits findings, conclusions, and recommendations 
contained in the report before the report on the attestation engagement is 
issued.^' Although workpaper documentation for the majority of the 37 
audits of contractor internal control systems we reviewed evidenced 
supervisory review, we found: 

• A lack of proper documentation of supervisory review in 13 audits. For 
example, for an Eastern Region accounting system audit, the 
supervisory auditor who signed the audit report did not review key 
workpapers related to accounting system transaction processing and 
transaction testing and cost allocations until 1 to 2 days after the audit 
report was issued. This was similar to a situation we found in our prior 
investigation, when siq^ervisors at one DCAA field office frequently 
reviewed the workpapers for forward pricing reports after the reports 
were issued. The auditors also performed insufficient testing on this 
audit. 

• Audit steps were deleted from the standard audit program in an 
accounting system audit and a billing system audit after the supervisors 
approved the audit programs. The supervisors did not ensure that the 
deleted steps were addressed or that documentation was added to the 


CA(Mi3-67yG, §§ 6.04a and 6.24e. 
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workpapers to expUun the reasons why the related audit procedures 
were not performed. 

For six other audits, audit documentation shows that the supervisors 
and FAO manageis extended the audit time frames while contractors 
took actions to correct significant deficiencies. The audit reports were 
issued 1 to 2 years later with adequate (“clean”) opinions on controls. 
Although this raises serious auditor independence and reporting issues 
because identified deficiencies were not reported, we are highlighting 
these cases under our discussion of poor supervision to also 
demonstrate the importance of “tone at the top.” 


OCAA Extended Audit and “Scrubbed” Audit Documentation after Contractor 
Objected to Findings 

A OCAA Western Region FAO failed to provide proper supervision of auditors throughout 
an accounting system audit of cxie of DOD's five largest contractors working in iraq. For 
contractor fiscal year ended December 31. 2004, the conU’actor reported over $900 
million in sates of which 98 pa'cent related to government contracts, including $250 
milHon for work in Iraq. The 2004 audit, which was initiated in November 2003, was 
transferred among severe auditors and at least three supen/isors before its completion 
and August 2006 publication. In September 2005, the contractor objected to draft 
Findings and recommendations that included eight significant deficiencies in the design 
and operation of the contractor's accounting system, including inadequate system 
access controls, tack of policies and procedures for segregation of duties, lack of 
periodic reconciliations of cost accounts to the general ledger, and insufficient cost 
ledger informaiion on total base costs by contract and cost elements for applying Indirect 
rates. The contractor staled that the auditors did not fully understand the new policies 
and procedures that were just being developed for the fast track effort in Iraq. 

Following the contractor's ot^tions. the auditors revised and deleted some workpapers 
and created new workpapers. GAO's review of the audit documentation identified several 
workpapers that were indexed to supporting documentation that no longer existed. 
Further, the auditors told GAO that because they had difficulty finding suppon for Iraq 
vouchers, they relied on vouch^ reviews performed under other DCAA audits. GAO also 
found evidence in the audit documentation that the final supervisor instructed the final 
lead auditor to insert the signature of a prior supervisor on an electronic workpaper after 
it had been revised, therel:^ makir>g it appear that the prior supervisor had approved the 
workpaper revisions. 

On August 31, 2006, after “scrubbing” the audit documentation at the supervisor's 
request, dropping five ^nificani deficiencies and downgrading three significant 
deficiencies to suggestions for improvement, DCAA reported an adequate {"clean") 
opinion on the contractor's accounting system. Waiting to review audits with significant 
deficierKies until the end of thepb after the work has been completed, raises questions 
about proper and timely supervision. The audit supervisor, who authorized the electronic 
recording of the prior supervisee's name on the audit documentation and supervised the 
issuance of the audit report, was subsequently promoted to be the Western Region 
QualKy Assurance Manager, where he went on to act as a quality control check over 
thousands of audits — including several of the audits investigated in GAO's prior work. 
Following GAO's review, DCAA rescinded the audit report on December 2. 2008. 
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Reporting Problems Audit reports are DCAA’s principal work product. According to GAGAS, 

audit reports should, among other criteria, (1) identify the subject matter 
being reported, the criteria used to evaluate the subject matter, the 
conclusion or opinion, and state that the opinion was as of a certain date; 
(2) include a statement of the nature and scope of the work performed and 
state that the audit was performed in accordance with GAGAS; (3) 
disclose any reservations about the engagement, including any scope 
limitations; (4) state the intended use of the report, if limited; and (5) state 
the time frame“ covered by the audit Our review of audit documentation 
and DCAA final audit reports determined that none of the 37 DCAA 
reports on contractor systems internal controls met these reporting 
standards, for example: 

• The reports did not cite the specific criteria used in individual audits. 
Criteria rq>resent the laws, regulations, contracts, grant agreements, 
standards, measures, expected performance, defined business 
practices, and benchmarks against which performance is compared 
and evaluated. Criteria identify the required or desired state or 
expectation with respect to the program or operation and provide a 
context for evaluating evidence and understanding the findings.®’ 
Instead, the DCAA reports uniformly used boilerplate language to state 
that DCAA audited for compliance with the “FAR, CAS, DFARS, and 
contract terms." As a result the user of the report does not know the 
specific Federal Acquisition Regulation (FAR), Cost Accounting 
Standards (CAS), or contract terms used as criteria to test contractor 
controls. This makes it very difficult for users of the reports to 
determine whether the report provides the level of assurance needed 
to make contract management decisions. In addition, audit 
documentation for many of the audits we reviewed did not identify the 
audit work performed to provide assurance that contractors complied 
with specific requirements in CAS, FAR, DFARS, or contract terms. 

• Six of the 37 audit reports were not issued at the time’’^ the work was 
completed. These reports were issued from 8 months to over 2 years 
after the audits were completed. Frequently, we found that the delays 
were the result of serious findings, which led DCAA to withhold 


hlCVk, Standards for Attestation Engagements, AT §101.63 incorporated by reference 
in GAO-03-673G, § 6.01, and (.JAO-07-731G. § 6.01. 

“GAO-07-73JG, §7.37. 

GACW)3-f)73G, §§ 6.50 and 6.24, and GA(W)7-731G, § 6,24. 
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issuance of the report while the contractor addressed the problems. 
Because testing was not updated or was not sufficiently updated, the 
reported audit opinions, which related to controls at the time the 
reports were issued, were not adequately supported and may have 
been inaccurate. 

• The audit reports stated the period during which the audit was 
performed but did not disclose the scope and timing for tests of 
vouchers, transactions, or control attributes. Some tests covered a few 
days in only one month or a 3*month period and did not test controls 
across the year audited. As a result, testing did not support the 
reported audit opinions as of the report dates. 

• Contractors imposed restrictions on the scope of four audits by 
denying DCAA access to certain records. The access-to-records issues 
were not fully resolved or disclosed by the auditors. 

• The scope of 33 audits was limited by DCAA imposed, or implied, 
restrictions, including inadequate audit resources, unclear audit 
guidance on nature and extent of testing, and time constraints that 
prevented auditors from performing sufficient work to support 
reported opinions on contractor internal controls. DCAA officials told 
us that DCAA does not have sufficient resources to perform full-scope 
audits of contractor internal controls. 

Failure to issue reports when sufficient evidence has been obtained to 
support an auditor’s conclusion puts decision makers at risk of relying on 
outdated or inaccurate information. Also, when DCAA auditors do not 
perform the scope of work necessary to support the reported audit 
opinions, the audit reports provide a false level of assurance. Following 
our discussion of these audits with DCAA headquarters officials, DCAA 
rescinded 4 of the 6 audit reports that did not accurately relate the period 
of testing to the audit opinion, and it rescinded 18 audit reports where the 
scope of work did rwt support the audit opinions. The discussion below 
describes a particularly egregious example of this problem. 
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Two Years after Testing Controls, DCAA Reported the Results of an Audit of a 
Muitibillion Dollar Contractor's Billing System 

In July 2003. DCAA initiated a billing system audit of a contracted' doing business in Iraq 
with sales of $6.3 billion at two divisions under audit More than 2 years after 
performing tea procedures and after spending 1,025 hours on the audit, the FAO 
Issued an opinion that the C(MiUa<^or's billing system controls were adequate as of 
August 31. 2005, without updating the testing. 

In 2003, DCAA auditors tested 38 vouchers submitted for payment within a 1 2-day 
period. DCAA auditors identified numerous billing errors, including two instances where 
billings did not comply with the Federal Acquisition Regulation (FAR), On August 12. 
2004, DCAA auditcds prepared a draft report with an adequate opinion and three 
suggestions for improvement. DCAA auditors did not perform testing in 2004 or in 2005 
despite the numb^ of errors found as a result of limited test procedures performed in 
2003. As a result, the evidence does not support the opnion that the contractor's billing 
system controls are adequate as of August 31 , 2005. Additionally, there is no evidence 
in the workpapers that the contractor resolved the errors DCAA identified and the 
underlying system deficiencies that caused those errors. This is of special concern 
because bilHr^ errors and system deficiencies at this contractor put multiple agencies 
at risk. For example, this contractor does work not only for DOD but also for the 
Departments erf Agricutture. Commerce, Interior, and NASA, and several other 
agencies. 

The lead auditor told us that this audit was delayed because numerous auditors were 
assigned over the course of this audit, and the contractor's work in Iraq took 
precedence over this audit. However, we found no evidence supporting a decision not 
to issue tNs report when the testing was completed in 2003. Following GAO's rewew, 
DCAA rescinded the audit report on April 7, 2009, 
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DCAA performs assignments that are designed to test various contractor 
costs as allowable, reasonable under the related contracts, the Federal 
Acquisition Regulation (PAR), and Cost Accounting Standards (CAS). 
Although DCAA uses the term ‘'audit" genetically, some of these 
assignments are audits and other assignments relate to fmancial and 
advisory services. We reviewed 32 cost-related assignments' performed by 
seven geogr^hically disperse field audit offices (FAO) across the five 
DCAA regions (the same offices as in appendix I) to assess whether (1) the 
tests of contractor costs, billings, and payments were effective in 
identifying overpayments, billing errors, and unallowable cost^ and 
(2) DCAA identified and reported unallowable and unsupported costs, 
overpayments, and billing errors so that the government was in a position 
to collect or recover improper costs and billings through refunds, contract 
adjustments, or ofisets. The 32 DCAA cost-related assignments we 
reviewed Included 16 paid voucher reviews, 10 overpayment assignments, 
4 incurred cost audits, and 2 request for equitable (REA) 

audits.’ Although DCAA performs incurred cost and REA audits as 
engagements in accordance with generally accepted auditing standards 
(GAGAS), DCAA does not consider paid voucher reviews or overpayment 
audits to be GAGAS assignments. DCAA performed the paid voucher 
reviews to assess the accuracy of contractor billings to support decisions 
to approve contractors for participation in the direct-bill program,^ 
whereby the contractor submits invoices directly to a federal agency 
paying office without government review of the invoices prior to payment. 
Overpayment assignments review contractor controls for identifying and 


' We initially selected 34 cost-related audit assignments for review. After reviewing the 
audit documentation, we determined that one assignment only covered part of an audit and 
the other assignment was terminated and the procedures were incorporated Into a related 
billing system audit. Therefore, we reviewed a total of 32 completed cost-related 
assignments. 

* Contractor overpayments can occur as a result of errors made by paying offices, such as 
duplicate payments and payments in excess of amounts billed, and contractor billirtg 
errors, such as using the wrong overhead rate, failing to withhold designated amounts on 
progress payments, duplicate billings, or billings for ui\aUowable cost. Recoveries of 
overpayments can be accompl^hed through refunds, subsequent billing offsets, or other 
adjustments to correct billing errors. Unallowable costs include lobbying cost, certain legal 
expenses, executive and management bonuses, luxury items, and certain overhead costs. 

’ REA relates to contractor requests to adjust contract terms for rates and payments 
resulting from contract modifications. In the case of the two REA audits, contract 
modifications related to reque^ for increased hours of service and related labor and 
materials. 

' FAR § 42.101 and DFARS § 242.803. 
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refunding, offsetting, or adjusting contract overpayments and billing 
errors. 

Similarly, DCAA performs overpayment assignments at the request of 
contracting officers to determine (1) whether contractor controls are 
effective in identifying oveipayraents made by disbursing officers or over 
billings and billing errors made by contractors and (2) if contactors are 
making timely refunds, onsets, or a^ustments. 

At the time the 32 cost-related assignments were performed, FAR § 52.232- 
25(d) imposed a requirement on contractors to immediately notify the 
contracting officer and request instructions for disposition of any 
overpayment when the contractor becomes aware of a duplicate or 
overpaid contract financing or invoice payment. * Also, FAR 32.604(b)(4) 
provides that contractors shall repay debts under a demand letter within 
30 days, except for certain debts covered by specific terms of the 
contract.® This time period is incorporated into most contracts under FAR 
Clause 52.232-17(a). We found that DCAA auditors are not consistent 
when assessing the timeliness of refunds and offsets. Specifically, 
although DCAA’s overpayment work program cites 30 to 60 days after the 
overpayment occurred as timely,’’ some DCAA auditors considered 90 days 
as timely which effectively minimized the impact on the contractors’ cash 
flow. 

We also found limited testing in the four incurred cost audits we reviewed. 
DCAA considers incurred cost audits to be GAGAS attestation 
engagements. Incurred cost audits examine contractors’ annual claims for 
payment of cost incurred. DOD contracting officers rely on DCAA incurred 
cost audits to approve contractor claims for payment.® DCAA incurred 
cost audits and proposal audits are the source of most DCAA questioned 
costs and dollar recoveries. Dollar recoveries are based on contracting 


* FAR 52.232-25(d) was amended in October 2008 to require contractois to monitor for and 
make adjustments to coirect overpayments they m^ receive, but it still does not specify & 
timeframe for making any needed at^uslments. 

‘FAK 32.606(a). 

' DCAA, Audit of Contract Overpayments Audit F*rogram, version 2. i , October 2006. 

® Although the government pays contractor invoices on a provisional basis when they are 
submitted for payment, DCAA incurred cost audits provide the basis for final approval of 
contractor incurred costs claims. 
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officer agreement with DCAA questioned costs.® DOD contracting officers 
are responsible for enforcing DCAA recommendations to disallow 
questioned cost Figure 3 provides a comparison of costs questioned by 
DCAA auditors and questioned costs sustained (recovered) by DOD 
contracting officers. 


Figure 3: DCAA Questioned Costs and Amounts Sustained by Contracting Officers 

DoHars (in batons) 

8 



0 I— .1 I 

2000 2001 2002 2003 2004 20DS 2006 2007 2008 

Ftacal y««r 

• • > QueatkkoeO costs 

Questtonod costs sustained 

Source GAO velyss o( OCAA deu 


For one of the four incurred cost audits we reviewed, DCAA rescinded the 
related accounting system audit report in response to concerns we 
identified with that report For a second incurred cost audit we reviewed, 
DCAA rescinded the related billing system report Risk assessments for 
determining the nature, extent, and timing of testing for incurred cost 
audits are based in part on the results of accounting and billing system 
audits. Therefore, a rescission of an accounting or billing system audit 


® Questioned cc^ts include costs questioned by DCAA auditors as unallowable or 
unsupported. 
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would call into question the risk assessment performed for the related 
incurred cost audits. 

The case study examples in table 6 illustrate significant problems we 
identified with the DCAA cost-related assignments we reviewed. As 
previously discussed, the level of testing in these assignments was not 
sufficient to identify all potential contractor billing errors and 
overpayments. 


table 6: Case Studies of Problem DCAA Cost-Related Assignments 


Region Type of assignment 

Central Paid voucher review (2006) 
Non-GAGAS 


Central Paid voucher 
review (2005) 
Non-GAGAS 


Western Paid voucher 
review (2005) 
Non-GAGAS 


Details of review 

For this review of paid coniractor invoices, the auditor relied on the resuTts oTbCAA's 
2005 billing system audit and did not test any invoices. The workpapers stated that the 
auditor also relied on the results of the 2005 paid voucher assignment. However, that 
assignment did not test any 2006 invoices. 

• Further, as a result of GAO's work, DCAA had rescinded the 2005 billing system audit 
report on February 10, 2009. 

• As a result, there is no audit support for DCAA's approval for this contractor to directly 
bill the government. 

~ In planning this work, the auditor improperly assessed risk as low and deleted several 
steps from the startdard "audit" program. 

• The auditor did not identify the population of vouchers (invoices) and selected two 
invoices for testing, but only tested one of them. 

• The auditor tested one invoice to see if the payment received by the contractor 
matched the amount billed. 

• On January 23. 2006. DCAA issued a Memorandum for the Record, stating "reliance 
can be placed on the contractor's procedures for preparation of interim vouchers. 
Accordingly, ihe contractor has met the criteria for continued participation in the direct 
billing program." 

"• Without documenting the population of vouchers or the total dollars billed during the 
contractor's fiscal year, the auditor tested 8 of 734 vouchers issued from April 1 6, 2004, 
through March 25. 2005. 

• The supervisor incorrectly dir«:ted the auditor to lest a final voucher. Paid voucher 
assignments focus on interim vouchers as a basis for making direct-bill decisions. Final 
vouchers are submitted to close out a contract. 

• The auditor did not Identic any errors in the vouchers tested. 

• On September 30. 2005, the auditor prepared a Memorandum for the Record, stating 
that "continued reliance can be placed on the contractor's procedures for preparation of 
interim vouchers. Accordingly, the contractor has met the criteria for continued 
participation in the direct billing program." 
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Region Type of assignment 

Details of review 

Eastern Paid voucher review (2004) 
Non-GAGAS 

• Although the contractor gert^'ated SI .1 bilJion in annual billings to the government, the 
audita assessed risk as low for this assignment. Without documenting the basis for the 
risk assessment, the auditor judgmentally selected 3 vouchers totaling $88,000 for 
testing out of a taal of 222 vouchers submitted to the government for payment from 
March 2003 through February 2004. 

• The auditor tested the first vojcher selected and performed limited testing on the 
remainirtg 2 vouchers. 

• The workpapers do rrat include any evidence to show that the auditor performed most 
of the audit steps required in the standard audit program. 

• Despite limited testing, on March 31 , 2004, DCAA prepared a memorandum for the 
record, statif>g “continued reliance can be placed on the contractor's procedures for the 
preparation of interim vouches" and “the contractor has met the criteria for continued 
participation in the direct billing program.’ 

ScHvce: GAO analysis ol DCAA audi docunieMauon 
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Pursuant to a request from the Chairman and Ranking Member of the 
Senate Committee on Homeland Security and Governmental Affairs, we 
conducted an agencywide performance audit to assess the effectiveness of 
Defense Contract Audit Agency (DCAA) audits for helping to assure that 
prices paid by the government for needed goods and services are fair and 
reasonable and that contractors are charging the government in 
accordance with 2 q>plicab!e laws, regulations, cost accounting standards, 
and contract terms. The overall objectives of oiu- work were to (1) conduct 
a broad assessment of DCAA’s management environment and quality 
assurance structure, (2) evaluate DCAA corrective actions in response to 
our prior investigation* and DOD Comptroller/CFO “tiger team” and 
Defense Business Board (DBB) studies, and (3) identify potential 
legislation and other actions that could improve DCAA’s effectiveness and 
independence. 

To address our first objective, we evaluated DCAA’s contract audit 
guidance and policies and its quality assurance program and assessed the 
quality of a nationwide selection of DCAA audits. We evaluated the results 
of internal DCAA audit quality assurance reviews on audits issued from 
fiscal year 2003 through 2008. We also reviewed a total of 69 DCAA audits 
and cost-related assignments.* In reviewing DCAA audits, we used 
generally accepted government auditing standards as our criteria* The 69 
DCAA audits and cost-related assignments we reviewed included 37 audits 
of contractor internal controls and 32 cost-related audits and assignments. 
We did not assess a statistical sample of DCAA audits. Rather, we focused 
on DCAA offices that reported predominately adequate, or “clean,” 
opinions on audits of contractor internal controls over cost accounting, 
billing, and cost estimating systems issued in fiscal years 2005 and 2006.* 
We selected DCAA offices that reported predominately adequate (“clean”) 


' GAO-08-857. 

* As stated in DCAA’s Contract Audit Manual, CAM 2-100, DCAA uses the tetm audit to 
refer to a variety of audits, evaluations, reviews, assessments, and analyses. 

* GAO, Govermnent Auditing Slatidards: 2003 Revision, GAO-0-%-<>75G (Washington, D.O 
June 2003) and Government Auditmg Standards: 2007 Revision, GAO-07-731G 
(Washington, D.C; July 2007). 

* In selecting the seven DCAA offices, we considered a 2-year history of internal control 
audit results. The seven DCAA offices we selected reported adequate opinions on 89 
percent or more of the internal control reports they issued during fiscal year 2006. During 
fiscal year 2005, four of the seven offices reported adequate opinioris in 85 piercent or more 
of the internal control reports they issued, and the other 3 offices issued adequate opinions 
in 50 to 69 percent of the internal control audit reports they issued. 
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opinions on contractor systems and related internal controls because 
contracting officers rely on these opinions for three or more years to make 
decisions on pricing and contract awards, and payment. For example, 
audits of estimating system controls support negotiation of fair and 
reasonable prices.*^ Also, the Federal Acquisition Regulation (FAR) 
requires contractors to have an adequate accounting system prior to award 
of a cost-reimbursable or other flexibly-priced contract.® Billing system 
internal control audit results support decisions to authorize contractors to 
submit invoices directly to DOD and other federal agency disbursing 
offices for payment without government review.^ In addition, DCAA uses 
the results of internal control audits to assess risk and plan the nature, 
extent, and timing of tests for other contractor audits. When a contractor 
has received an adequate opinion on its systems and related controls, 
DCAA would assess the risk for subsequent internal control and cost- 
related audits as low and would perform less testing on these audits. 

Using this approach, we identified seven geographically disperse DCAA 
field offices within the 5 DCAA regions and targeted 39 audits of 
contractor cost accounting, billing, and estimating system controls issued 
during fiscal years 2004 through 2006 for review.® These were the most 
recent completed fiscal years at the time we initiated our audit. Two of the 
39 internal control audits we identified were performed as assist audits to 
a billing system audit and we considered them as part of the billing system 
audit we reviewed. Therefore, we reviewed a total of 37 audits of 
contractor internal controls for compliance with GAGAS and DCAA 
policy. We also considered whether DCAA adequately applied internal 
control standards in its audits that are applicable to the private sector.® We 


® DCAA Contract Avdit Manual (CAM) 5-1202. la and Defense Federal Acquisition 
Reffulation Supplement (DFARS) § 215.407-6. 

®FAR| 16.30I-S(a)(l). 

^ FAR § 42,101, and DFARS § 242.803. 

® In th€ case of follow-up audits, we also reviewed the documentation for the previous audit 
to gain an understanding of the scope of work and deficiencies previously identifled. 

® The Internal Control Integrated Framework developed by the Committee on Sponsoring 
Organizations (COSO) of the Treadway Commission, September 1993, are applicable to 
private sector entities. We con»dered whether DCAA audits addressed contractor controls 
related to the five key control activities: (1) contractor control environment; (2) contractor 
risk assessment; (3) control activities, including policies and procedures and segregation of 
duties; (4) information and communication (i.e., information system processing controls); 
and (5) monitorit^ 
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did not review classified audits performed by DCAA’s field detachment 
office. Although our selection of the seven offices and 37 internal control 
audits was not statistical, it represented about 9 percent of the total 76 
DCAA offices that issued audit reports on contractor internal controls and 
nearly 18 percent of the 40 offices that issued 8 or more reports on 
contractor internal controls during fiscal year 2006. Of the 37 internal 
control audits we reviewed, 32 reports were issued with adequate opinions 
and 5 reports were issued with inadequate-in-part opinions. Table 7 
summarizes the number and types of contractor internal control audits we 
reviewed for seven FAOs across the 5 DCAA regions. 


Table 7: Summary of DCAA Audits Reviewed for GAGAS Compliarice 



Type of interi>ai control audit 




Region/FAO 

Accounting system 

Indirect & other 
direct cost 

Billing system 

Estimating 

system 

Total internal 
control audits 

Northeast 

FAO #1 

— 



3 

1 

4 

Mid-Atlantic 

FAO #2 

2 

— 


3 

- 

5 

Eastern 

FAO #3 

1 

1 


3 

1 

6 

Central 

FAO #4 

2 

- 


2 

1 

5 

FAO #5 

2 

- 


5 

- 

7 

Western 

FAO #6 

- 

1 


3 

1 

5 

FAO #7 

2 

— 


1 

2 

5 

Total 

9 

2 


20 

6 

37 


At the same seven DCAA field offices, we selected 34 cost-related 
assignments performed during the same period as the internal control 
audits we reviewed and analyzed supporting documentation to determine 
whether the assignments included sufficient testing to assess whether 
(1) the tests of contractor costs, billings, payments were effective in 
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identifying overpayments, billing errors, and unallowable cost'" and 
(2) DCAA reported overpayments, billing errors, and unallowable and 
unsupported costs, so that the government was in a position to recover 
improper pajnnents through refunds, contract adjustments, or offsets and 
avoid payment of unsupported and unallowable costs. Upon reviewing 
documentation for the 34 cost-related audits, we determined that one of 
these assignments covered the risk assessment portion of an incurred cost 
audit and was not a complete audit. Documentation for a second 
assignment to test for overpayments was terminated and the audit 
procedures were rolled into a billing system audit. Consequently, as shown 
in table 8, we reviewed a total of 32 cost-related DCAA assignments. These 
assignments included paid voucher reviews and overpayment control 
assignments and audits of requests for equitable adjustment (REA)" and 
contractor incurred cost claims. 


Table 8: Summary of DCAA Cost-Related Assignments Reviewed 



Type of Assignment 






Over payment 




Region/FAO 

Paid Voucher review 

assignment REA audit 

Incurred Cost audit 

Total assignments 

Northeast 

FAO#1 

- 

1 

2 

2 

5 

Mid-Atlantic 

FAO#2 

4 

1 

- 

1 

6 

Eaetern 

FAO #3 

3 

3 

- 

- 

6 

Central 

FAO #4 

1 

1 



2 

FAO #5 

5 

2 

_ 

- 

7 


Contractor overpayments can occur as a result of errora made by paying offices, such as 
duplicate payments and payments in excess of amotmts billed, and contractor billing 
errors, such as using the wrong overhead rate, failing to withhold designated amounts on 
progress payments, duplicate billings, or billing for unallowable cost. Recoveries of 
overpayments can be accomplished through refunds, subsequent billing offsets, or other 
adjustments to correct billing etrors. Unallowad^le cost include lobbying cost, certain legal 
expenses, executive and management bonuses, luxury items, and certain overhead costs. 

" REiA audits relate to reviewing contractor requests for adjustments in billing rates 
pursuant to contract modifications. For example, if a contractor is asked to provide 
additional services or expand hours of service, contract costs would need to be 
recalculated and adjusted rates verified. REA audits relate to audits of contractor 
estimating system controls. 
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Type of Assignment 

— 



Region/FAO 

Paid Voucher review 

Over payment 

assignment REA audit 

incurred Cost audit 

Total assignments 

Western 

FAO #6 

3 

1 

- 

- 

4 

FAO #7 

— 

1 

- 

1 

2 

Total 

16 

10 

2 

4 

32 


Source: GAO analyse ol DCAA tnanagemeni MormiUion sysicm data. 


The details of our assessments of DCAA audits of contractor internal 
control systems and cost-related audits and assignments are included in 
sqjpendixes I and II, respectively. Examples of our findings are included in 
the body of this report to help illustrate the effect of our findings related to 
DCAA’s management environment. 

To assess DCAA’s management environment and quality control system, 
we reviewed DCAA’s mission statement, strategic plan, performance 
metrics, quality assurance program, audit planning and policy guidance, 
and human capital management We evaluated the results of internal 
DCAA audit quality assurance reviews on audits issued from fiscal year 
2004 through 2008. We used requirements in the Government Performance 
and Results Act,'* GAGAS, and GAO’s Standards for Internal Control In 
the Federal Government'* as our criteria. 

We analyzed the findings, conclusions, and recommendations in the DOD 
Inspector General’s (IG) 2CM)7 report on its oversight review of DCAA,'* 
which serves the purpose of a peer review. We did not review DOD IG 
documentation for the overeight review. In assessing the DOD IG peer 
review conclusions and opinion, we considered the inconsistencies 
between the findings and recommendations in the IG report. In addition, 
we considered the results of our analysis of DCAA audits in our prior 
investigation; our review of the 69 DCAA audits and related assignments 


'^Pub. L No- i03^2. lOTStal. 285(Aug, 3, 1993). 

’’ GAO-034573G, and GAO-07-731G. 

GAO, Standards for Internal Control in the Federal Government, GAO/AIMD-21.32.1 
(Washington, D.C.: November 1999). 

'* DOD Inspector General, Oversight Review: Review of the Defense Contract Audit 
Agency Quality Contrx^ System, Report No. D-2007-6-006 (Arlington, VA: May 1, 2007). 
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covered in this report; the results of DCAA’s internal quality assurance 
reviews; and DCAA’s actions to rescind 80 audit reports. 

To achieve our second objective, we reviewed the status of several key 
actions that DCAA initiated as a result of our earlier investigation, 
including efforts to 

• revise DCAA’s mission statement and strategic plan to focus on 
protecting the public interest; 

• change performance metrics to focus on audit quality instead of 
performing large quantities audits; 

• end DCAA involvement with integrated product teams, which we 
identified as an impairment to DCAA’s independence; 

• improve audit quality by revising audit policy guidance and realigning 
DCAA's audit quality assurance structure; and 

• update training courses to reflect changes in DCAA’s mission, metrics, 
and audit policy. 

Although the October 2008 Defense Business Board report recommended 
that the Secretary of Defense revise DCAA’s mission statement to focus on 
protecting the public interest, at the time we completed our work in July 
2009, DCAA’s mission statement had not yet been revised. To assess 
changes in performance metrics, we analyzed DCAA’s new metrics and 
determined whether changes made in September 2008 were effective in 
shifting DCAA focus from report production to performing quality audits 
and if the new metrics had been integrated into DCAA’s performance 
plans, auditor expectations, and performance appraisal standards. In 
addition, we made selected calls to one or more auditors in 15 selected 
DCAA offices that were separate from the offices we visited to review 
audit documentation and interviewed auditors about their experience with 
changes in DCAA policies and performance metrics. We also considered 
34 addition^ hotline allegations we received from auditors across the 5 
DCAA regions after our investigative report was issued. We used GAGAS 
criteria'* to assess the effectiveness of DCAA policy changes and DCAA’s 
centralization of the audit quality function aimed at improving auditor 
independence and audit qu^ty. We used GAO’s Internal Control 


** GMyrn-CiTid, and GACM)7-7310. 
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Standards as our criteria for assessing DCAA’s management environment, 
culture, need for a risk-based audit approach, and human capital practices. 

To achieve our third objective to identify potential legislative and other 
actions to improve DCAA's effectiveness, we considered DCAA’s current 
role and responsibilities; the framework of statutory authority for auditor 
independence in the Inspector General Act of 1978, as amended;'^ best 
practices of leading organizations that have made cultural and 
organizational transformations; our past work on DCAA organizational 
alternatives;** GAGAS criteria for auditor integrity, objectivity, and 
independence; and GAO’s Standards for Internal Control*® on managerial 
leadership and oversight We identified potential short-term and longer 
term legislative actions and organizational changes that could enhance 
DCAA’s effecriveness and independence. 

Throughout our audit we met with the DCAA Director and DCAA 
headquarters policy, quality assurance, and operations officials and DCAA 
Region and FAO managers, supervisors, and auditors. We also met with 
DOD Office of Inspector General (OIG) auditors responsible for DCAA 
audit oversight and DOD IG hotline office staff We assessed the reliability 
DCAA data used in our work by reviewing DCAA procedures for assuring 
the reliability of reported performance data, discussing the compilation 
and use of these data with DCAA operations personnel, and perfonning 
analytical procedures to determine the reliability of specific data used in 
our analysis. For example, we determined that DCAA assignments 
initiated in one year and completed in the second year were double 
counted. We eliminated duplicate records from data used for our analysis. 
We also met with the former DOD ComptrolIer/CPO to discuss plans for 
the Office of Comptroller/CFO and Defense Business Board reviews, and 
we continued to meet with and obtain information from the new DOD 
ComptroUer/CFO and his staff. We also met with the Comptroller’s new 
DCAA Oversight Committee, which includes the Auditors General of the 
Army, the Navy, and the Air Force; the DOD Director of Defense 
Procurement and Acquisition Policy; and the DOD Deputy General 
Counsel for Acquisition. 


5 U.S.C.. App. 

'* GAO, Defense Contracl Atidits: Current Organisational Relationships and 
ResponsibHities, GAO/A1''MD'01-I4 (Washington, D.C.: Apr. 3, 1991). 

‘® GAO/AIMT)-09-21.3.l. 
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We conducted this performance audit from August 2006 through 
December 2007, at which time we suspended this work to complete our 
investigation of hotline complaints regcirding audits performed at three 
DCAA field offices. We resumed our work on this audit in October 2008 
and performed addition^ work through July 2009 to evaluate DCAA’s 
quality assurance program during fiscal years 2007 and 2008, assess DCAA 
corrective actions, and consider organizational placement options. We 
conducted our audit in accordance with generally accepted government 
auditing standards. Those standards require that we plan and perform the 
audit to obtain sufficient, appropriate evidence to provide a reasonable 
basis for our findings and conclusions based on our audit objectives, We 
believe that the evidence obtained provides a reasonable basis for findings 
and conclusions based on our audit objectives. We performed our 
investigative procedures in accordance with quality standards set forth by 
the Council of the Injectors General on Integrity and Efficiency (formerly 
the President’s Council on Integrity and Efficiency). 
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Note: GAO comments 
supplementing those in 
the report text appear at 
the end of this appendix. 


UNDER SECRETARY OF DEFENSE 
t too oenNBc pcntagon 

WASHINCTON. OC 2030t-1 10D 

SEP “4 !30S 

eoMrraaujx 

Mr. Gregory Kuiz 

Mn^g Director, Fotenstc Audits utd SpeciaJ Investigations 
Covcfiunent Accountabiiiiy Office (GAO) 

44lO.SL,rrW 
Washington, DC 20S48 

Dear Mr. Kutz; 

This is the Dqiartment of Defense (DoD) response to the GAO draft report GAO* 
09-468, *'EX1AA AUDITS: Widespread Probiems with Audit (Quality Require 
Significant Reform,*’ dated July 3], 2009 (GAD code 195099). We ihartkyou for the 
opponuni^ to respond to the GAO draJt report and recomroendatiom. Th^ 
recommendaiions directed to the DoD Inspector General will be provided directly by that 
office under separate cover. 

The Department concun with all but one of the GAO lecommendaiiDns 
(Errclosiire I). We disa^xe with some ofOAO comments for Congressional 
consideration (Enclosure 2). Eftcloisurt 3 contaitts a listing of corrective actions DCAA 
has implemented sirtcc 20(ffi. As part of our review of the GAO draft report, we noted 
several areas vdiere we believe h^er clarification and explanation are needed so the 
circumstances can be completely undentood The eJarilyteg comraenu are provided in 
Enclosure 4. Comments from the Director, Defense Erooiremenl and Acquisition Policy 
are provided as Enclosure 5. 

The Department and frie Defense Coilract Audit Agency (DCAA) are commined 
to taking the necessary corrective actions to addicas the GAO findings. This office will 
continue to monitor DCAA to ensure timely complctioo of critical actions to address the 
OAO’s cecommend^oas. To assist with this monitoring, in March 2009, 1 established a 
DCAA Ovenight Committee to |vovide my office advice and recommendations related 
to dte oversight ofDCAA. This committee includes Auditors Genera) ofthe Amy, the 
Navy, and the Air Force; the Director orDefeitse Procuremeol and Acquisition Policy; 
and (he DoD Deprty General Counsel for Acquisition and Technology. The committee 
will assess DCAA's activities, its corrective actions taken to this and other oversight 
reports, and identify any gaps. I have also assigned a member of my senior staff to assist 
in the oversight efforts. 

We acknowledge that the draft GAO report raises serious issues that we need to 
continue to address. We will continue to improve audit quality, especially for mtemal 
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c(mtroi audits. Wc wUI reassess the number of audits that DCAA perfomt and ensure 
that adequate staffing is avaitable to conduct those audits in accordance with generally 
accepted goveiiunait auditing standards (GAOAS). We will etaiue that EKi^AA has 
adequate odepesdence. We will also ensure that an appeals mechanism is created to 
provide a process for rest^vic^ disputes between DCAA and die contracting 
organizations. 

While we acknowledge that continued work on these seritws issues is required, we 
disagree with the suggestion in the OAO report that we have not yet begun to address the 
weaknesses. The OAO repon states that **000 snd DCAA have not yet addressed the 
fundamental weaknesses in DCAA’s mission, strategic plan, metrics, audit approach, and 
human coital practices that have had a detrimental effect on audit quality.” We believe 
that we have begun to address these issues. The audit assignments covered by this review 
were conifrfeted 3-5 years ago. several years before DCAA iropkinmtted a series of 
corrective actions begiraing in late 200S. Although a significant number of short-lenn 
actions have been completed, DCAA has many long-tenn actkms stili in-process. It may 
take seven! yean to experieiKe the full effect on the execution of the DCAA audits. 
Enclosure 3 contains the list of conective actions DCAA has implemented in late 2008 
and to-date in 2009. 

While we acknowledge GAO's findings are seriMis, DCAA has and continues ui 
play a vital role in support of the contracting process in ensuring that DoD jmys a fair and 
reasoiable price in accordance with applicable regulations in protecting the taxpayers' 
dollars. In FY 2008 alone, DCAA audits recommended reductions in proposed or billed 
costs ofSi7.9 billion (referred to as questioned costs) and $7.2 billion in estimated costs 
whoe the contractor did not provide sufficient information to erqrlain the basis of the 
estimated amounts (referred to as unsupponed costs). Additionally, the cutraii Director 
of Defense Procuremem and Acquisition Policy, a key DCAA stakeholder, has suted that 
he finds DCAA's work critical to the acquisition process (Enclosure S). 

OCAA's important work was showcased in three hearings of (he Commission on 
Wartime Contracting in 2009. One hearing focused on contracts business systems, a 
type of audit that is the subject of the CAO report. Through June 2009, DCAA has cited 
deficiencies in contractor systems in over hairofthe 200 audits performed on the 
contractors performing effort in-theater. The Commission lemaiked that hundreds of 
millions of dollars have been recovered as a result of DCAA's audits ai>d that DCAA’s 
efforts were extraordinary ctxisidering the performance of audits in a war zone. Several 
of die Commissioners remarked during a recent hearing that DCAA was the finest audit 
ewganiution they had worked with and the most forthright and responsive of all the 
orgartizations that have interacted with the Commission to date. 
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Scveial of the key actions DCAA has taken to address DCAA’s management 
environment involved the use of external organizations to guide DCAA through its 
‘'cultural transformation." For example, DCAA has engaged the Nava! Post Graduate 
School’s Center for Defense Management Reform to assist with the development and 
execution of various long-ienn organizational improvement projects. These projects 
address the following questions: 

1 . How can DCAA pul people first to guide its decisions, actions and 
values? For example, how can DCAA place an increased emphasis on 
“soA skills" such as building morale and developing employees (in 
termsof a broad understanding as well as technical proficiency)? 

2. How can DCAA develop leaders to serve the employees and the 
organization? 

3. How can DCAA stnicture the organization to ^cilitate compliance with 
GAGAS, maximize audit re$uU&''retum on investment (ROI), and better 
align Agency woikload/resources? 

4. How can DCAA identi fy and resolve differing stakeholder expectations 
with contracting officers, contractors, the public (Congress), and 
external review organizations? 

DCAA has also engaged the Army Force Management Support Agency (AFMS A) 
to assess DCAA'srisk'based audit requirements planning process for FY 2010. AFMS A 
will also assist in translating (be requirements planning into staffing needs. 

One of (he major findings repened by the GAO is the lack of suffictent transaction 
testing to support the conclusions when giving an opinion on contractor internal control 
systems. We concur that many of the assignment working papers did not reflect the level 
of testing required by the GAO to opine on the system of internal controls. DCAA has 
rescinded audit reports and initiated full scope internal control audits at these locations. 

In light of the GAO’s findings, E>CAA will be assessing the need to opine on contractor 
internal controls or whether an opinion on the sufficiency of the contractors’ business 
systems for Government contacting purposes is appropriate. We suggest that the GAO 
and the DoD Inspector General (IG) woiic closely with DCAA in its assessment and 
redesign of testing procedures for opining on contractor business systems. 

It is worth noting that the additional transaction testing will require an increase in 
audit staff at DCAA. Some of (he increase is already underway through (he use of the 
Defense Acquisition Workforce Development Fund Using this fund, DCAA has 
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increased staffing by 300 in FY 2009 and plans to increase by an additional 200 each in 
FYs 2010 and 201 1, with a loial incr^se of 700 by the end of FY 2011. However, this 
may not be enough to accomplish the audits required by regulation in light of the 
additional testing stipulated by the GAO. We will continue to monitor the staffing 
situation at DCAA. But to accomplish the significant increase in toting during internal 
cwitrol audits, DCAA will be required to defer lower risk assignments to FYs 2010 and 
201 1, which could have a negative impact on the timely closing of contracts prior to the 
cancelation of funds. The overall issue of ri^ assessment, as outlined in die GAO draft 
report, is one of the main discussion topics 1 have assigned to the DCAA Oversight 
CommiQee. 

The Department cmcurs with the GAO that the root causes for many of the 
GAGAS noncompliances related to the prior DCAA perfomtance measures. As the GAO 
acknowledges, in September 2008, DCAA took aggressive action by revising the 
performance measures to promote quality audits. During FY 2009, DCAA has 
continually assessed the perfrxmance measures by conducting focus groups in several 
regions (including the DCAA Western Region). In general, the focus groups conltmted 
that there was much less emphasis on performance measures than in the past. 

The GAO draft report states that DCAA has taken some actions to improve its 
quality assurance program; however, it stated that staffing difficulties and other issues 
have left the outcome of this in^rtani initiative uncertain. We disagree. DCAA has 
been proactive in standing up its new Inte^ty and Quality Assurance Directorate - 
essentially a new quality assurance organization that reports directly to the 
Director/Deputy Director. DCAA has icvised iis quality assurance program for reporting 
GAGAS noncompliances and requires audit offices to provide conective action plans that 
address all GAGAS noncompliances reported. The Headquarters Quality Assurance 
organization will foilow-up on each systemic ncmcomptiance to ensure the field audit 
offices have corrected their processes. In fuly 2009, DCAA was auihcmzed a Senior 
Executive Service position to lead the Quality Assurance Directorate. We believe ihe 
extensive overhaul of the quality assw^ce function accomplished in FY 2009 will 
mitigate the prior shortcomings in audit quality cited by the GAO. 

In January 2009, the DCAA Director established a Senior Advisory Council for 
fmprovement which is led by the Director and comprised of Headquarters senior 
executives. The Council’s immary purpose is to establish and monitor the actions in 
response to the report issued in January 2009 by the Independent Review Panel to the 
Defense Business Board and findings fmm the GAO and DoD IG reviews. The 
establishment of this council exemplifies the Director’s efforts in ensuring key Agency- 
wide actions arc managed at the Headquarters level versus Ihe re^onal level. We believe 
the esiablishment of this DCAA Headquarters council, in addition to re-aligning the 
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Quality Assurance l^o^am to report directly to the Director/Depuly Director, results in 
significant progress toward addressing the OAO's concerns with DCAA’s “decentralized 
structure dM has fostered a culture ofDCAA region aitonomy.'* 

The GAO draft report states that the supovisors responsible for deficient audits 
identified in GAO’s prior investigation were promoted even (hough the OAO 
Investigation disclosed significant GAGAS noncompliances with the audits they 
siq>«vised. The GAO stales that “despite these Tindings, we found no evidoice that 
supervisors and auditoR who did not follow GAGAS atd DCAA policy were disciplined, 
cowueled or required to take additional training.” DCAA has required several of the 
supervisors to uAe addition^ supervisory and mana^ment training courses. They have 
completed some of these counes and are scheduled to take additional trainmg in the next 
fiscal year. Based on advice provided by the DoD Washington Headtpiarters Services 
Office of Generti Counsel, DCAA did noi take performance or conduct actions against 
these supervison, Addrtkmally, all DCAA employees, including the employee involved 
in (he GAO's 2008 hodioe tovestiptitm, have cMnpleted annual (raining on auditor 
“imtependmee” and training n au^t quality, including GAGAS, at mandatory stand- 
down days in August 2008 and 2009. 

We appreciate the recomcnendaiions made by the GAO. We believe the 
implementation of these recommendations along with the many actions that the 
Department and EXi^AA have already completed will Improve DCAA culture and 
management cnvinMiment to ensure taxpayer dollars are protected and DoD audh needs 
are met. DoD and DCAA leaden are ccunmined to maintaining a strong contract audit 
ftmetion. 

My point of contact on this matter is Mr. M. Wayne Goff. He can be reached by 
e-mail at waynagoff^osd.tnilor by lelq>hene si 703'6024374. 

Smcerely, 

Robert F. Hale 

Enclosures: 

As stated 
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GAO DRAFT REPORT DATED JULY 31, 2009 
GA04>9^8 (GAO CODE 195099) 


-OCAA AUDITS: WIDESPREAD PROBLEMS WITH AUDIT QUALITY 
REQUIRE SIGNIFICANT REFORM*' 

DEPARTMENT OF DEFENSE COMMENTS 
TO THE GAO RECOMMENDATIONS 


RECOMMENDATION 1 : Dk GAO teMOimends that the Secrctaiy of Defense revise 
dte Defenie Contmct AwKt A^otcy’s (DCAA) mission aatODcnt to reflect the need ibr 
quality contract audits and reiatad oonaudit services that lake into account saving the 
puMic interest. 

POD RESPONSE : Connr. The Depanmem is curmUy seeking final coordination oo a 
revised DCAA misskm siatemenl which is included in an updated DoD Directive 
5I03,3«.DCAA. 

RECOMMENDATION 2 : The GAO recommends that the Secretary of Defenre require 
the Under Secretary of Defense (CompOoilo/CFO) to eslaMish milesiooes for 
completing DCAA eonective actions and monitor aod regularly report on DCAA 
progress to assure timely completiofi of cridcal actints. 

DOD RESPONSE : Concur. The DepanmeBt will conlinne to establish mitcsones for 
completing DCAA cortective actioni. DCAA already provides USD(C) a monthly status 
repoR of dK actioiu taken in icspcnae to the leconuncadaiioRS made by the Independent 
Review Pane] of the Defense Business Bonid as well as itconuneodations from various 
GAO and DoD K# reviews. DCAA will etqMnd its improvement plan to incorponue the 
GAO’S recommendaiioas. USDfC) has assigned a senior staff member to assist in 
oversight and has created the DCAA Oversight Committee, includiog all three auditors 
general from the Servket, the OSD Deputy General Counsel for Acquisitioa and 
Logislics. and the Oiiectof of Defense Procurement and Acquiutioa Policy, to assist in 
oversight efforts. 

RECOMMENDATION 3 : TheGAO recommends that the Secretary ofDefeTue direct 
the Under Secretary of Eiefeose (Cmnptroller/CFO) to require the Director of the Defense 
Contnet Audit Ageoey (DCAA) in coitcen with the revised mission statement, develop a 
Strategic Plan with shcHt-teim wid iong-lenn outcome-related goals. 

DOD RESPONSE : Concur. DCAA has already started developing a revamped Strategic 
Plan with shon-ienn and ior^-tenn outcome-relaied goals that is in concert with the 
proposed mission statement. Assuming the revised mission statement will be approved 
by about October 2009, DCAA b expected to complete its strategic plan by November 
30, 2009 for publication and dissemination to the DCAA workforce. 
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RECnMMFWDATIQN 4 : Hw GAO recommends that the Secretary of Defense direct 
the Under Secretary of Defease (Coopoollet/CFO) to require the Director of the DCAA 
to measure progress iit aclueving strategic goals, enswe metrics Ik to the revised 
mtssioa stateneot aad strategic plan and st^port the agency’s annual work plan. 

POD RESP(WSE : Coacur. USD(C) will require DCAA to measure progress in 
achieving siraegic goats. Once DCAA’s revised misska siamnent and arat^c plan are 
ftnalced. USD(Q will require DCAA to ensure that DCAA performance measures tie to 
the revised reission statement aiwl sosic^c plan and support the Agency’s annual woik 
plan. 

RECOMMEI^ATIQN S : The GAO recominends that the Secretary of Defoise direct 
(he Under Secretary of Defense (Compooller/CPO) to teqimt the Director of the DCAA 
to consult wife DoO stakeholdeis and engage outside experts to develop a risk>based 
contrect audit ^(voach that identifies resource Rquiiementt, and focuses on perfbming 
quality audits Ito meet geoeraJly accepted govemmesu auditing standards (OAOAS). 

POD RFSPQMSE : ^utialiy Concur. The maiority of DCAA audits and other services 
are required by laws and regulations as outlined in the CAO dreh report. DCAA already 
has a risk-based contract audit approach in kjenti^Bg resource requirements. DCAA 
performs aruuiol audit requirements platutittg procedures to establish staffing 
requiiemeats baaed on its regulatory/staiutofy audit lequiremenis and audit risk. An 
eximptc of DCAA’s risk-based audit approach for incuied cost audit requiremaus is 
DCAA's perlbrniaace of desk reviews of the low risk contnetor's iiKuired cosu on a 
cyclical basis in tku of perfoiraing a full incurred cost audit every year. Nevenheless. 
US0(C) will task DCAA to coordinate with fee Under Secie^ of Defense for 
Acquisition. Technology, and Logistics to assess DCAA audit requiremenia since any 
sigiiificanl chaige in DCAA audit requiiemeats would involve a change in acquisitiOfi 
pelky. In addhkm, DCAA has engaged the Naval Post Onduau School (o assist in hs 
‘'cultural transformiuion.’' One of the projects is identifying ard resolving differing 
stakeholder expectations while cirsuiing DCAA peifanos quality audrb that meet 
GAGAS. DCAA’s efforts will include consulting wife DoD stakeholders and engaging 
outside experts as part of feia project. The Departmem will eonplete its auessmeni by 
December 2010. 

RECOMMENDATTON 6 : TheOAOrcconunendsIhal the Secretary OfDefeosedirect 
the Under Scaetary of Defense (ComptroHer/CFO) to require the Director of fee DCAA 
to esubiish u SES-icvcl position wife responsibility for audit quality assurance that 
requires deitwostrated kitowledge and exp^ence in applying professioital audit 
standards. 

DOD RESPWSE : Cdncw. In August 2009, DCAA established fee position of 
Assistant Director, Integrity and Quality Assurance with responsibility for DCAA’s 
quality assurance program. On luly 9, 2009, this posliion was approved os an SES-kvel 
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posidonandchejobannouiuemeDthasbeenpuWidied. DCAA expects to fiil this 
position b> October 2009. 


J: The GAO lecommends that the Secretaiy of Defense direct 
the Under Secretary of Defenae (ContpOoller/CFO) lo require the Director of the DCAA 
(0 establish a separate DCAA iotefnal review oryanization to conduct critical internal 
ia^Mclor general ftmctions, including petfotming periodic internal evaluations and 
reviews and addresstng DCAA hotline complaiDts. 


POO RESPONSE : Concw. DCAA wOJ esablish as^arate hriereal review 
orguiiznion to conduct critical iotemal inspector genenl ftmctions, including perfaming 
periodic internal evaluuioiu and reviews a^ addressing DCAA hotline coo^Uiiits and 
serve as the Agency’s ombudsman. Tlw new organization will be estabiidred by 
Deoember 2009. 

RECOMMENDATION 8 : TheOAO recommaals that the Seoetary of Defensedif«t 
the Under Secretary of Defense (Compirolkr/CFO) 10 leqiBie the Director of the DCAA 
u> review DCAA’s ctsmti portfolio of audit and oooaudit services to detenoine if any 
shoold be transferred, or reassigned to ■nothcr DoD agency, or terrainated in ndet for 
DCAA lo comply with OAOAS integrity, otqectiviiy, and independence requirements. 

DQO RESPONSE ; Concur. USD(C) will require DCAA to assess its current portfolio 
of audit and nonaudit services to deioBune if any should be tnufetred, or reassigned to 
another DoD agency, or terminated in order for DCAA to comply with QACAS integrity, 
ot^ivity, and independence requiiemenis. DCAA wilt r^it the results of its 
assessment to USD(C) by March 2010. However, as stated above, the majority of DCAA 
audits and run-audit services ate reqmted by regulation or statute. As acknowledged by 
tiieOAO in its report, DCAA has already p^otmed some of this assessment resulting in 
the etixoination of DCAA awiitoc participation as members of Intcgtaied Product Teams 
and Source Selection Evaluation Boards. 

RECOMMENDATION 9 : Ihe CAO reermunends that ibe Secretary of Defense direct 
the Under Seetetaiy of DefeMefComptreller/CPO) to require the Director of the DCAA 
based on the risk-based audit t qrpro acb to develop a staffing plan that kfentiftes auditor 
teaotiree requireroenis as well as audilor skill lev^s and (raining needs. 

DOD RESPONSE : Conew. DCAA is entering into an agreement with the Army 
Management Stqrpon Agency to evaluate DCAA’s requirements planoiog process and 
resulting stalling assessment for FY3Ot0. The Anny will also provide an overall 
opinion on the sulficteney of DCAA staffing lo provide audit coverage in liiK with its 
mission and strategic plan and ftiJly comply with Geuerally Accepted OovoTBSent 
Auditing Stmdaids. In additioo. DCAA has an internal education specialist to provide 
expert advice oa DCAA training and an imonal staiirticiao to provide expert a^ce on 
statistical sampling audit techniques and training. 
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RECOMyH^DATtOM tO : The GAO recoiTOMMls that (he Secretary of Defense direct 
dw Under Secieouy of Defense (Compiroller/CFO) to require (be Director of the DCAA 
to establish a position for an expert on auditing sta^ards or consult with an outside 
expert on auditing standards to assist in revising contract audit policy, imviding guidance 
on sampling and testing, and dcvelopittg training on professional auditii^t standards. 

POD RESPONSE : Concur. The USD(C) will require DCAA to consult with an outside 
expert im auditing standards to assist in revising contract atrdit policy, proviibng guidance 
on sampling and testing, tmi developing mining on professional auditing stattdards- 

RECOMMENDATION 1 1 : The GAO reconunenda ibM the Secietaiy of Defense direct 
the Under SecictMy of Defoase (Contptrolla/CFO) to require the Dtiwlor of the DCAA 
to revise DCAA audit policy to provide appropriate guidance tn what conttitutes 
sufficient leotng to ctn^y with GAGAS. Update DCAA's Contract Audit Manual, as 
appropriate. 

POD RESPONSE : CcnctB. USD(C> will requite DCAA to issue audit policy on wbal 
cortstiniies tuffrcicBt testing to con^y with GAGAS and t^daae DCAA*s Contract Audit 
Manual. DCAA will con^lete this action by December 2009. 

RECOMMENDATION 12 : Tbe OAO lecoouneitds that the Secretary ofDefRisediiect 
the Under Secretary of Defense (ComptioUet/CFO) to lequiie the Director of the DCAA 
to develop ageitcy wide (Tuning m govemmem audit standanla. Ihis Iraiiting should 
emphasize the level ofauurettce intended by the various types of engagements and 
provide detailed guidance on auditor independence, planning, baud risk, level of testing, 
supervision, auditor judpnetu, audit documentation, and reporting. 

POP RESPCTfSg : Concur. DCAA is ctnently developing a revised training course on 
Gtmerally Accepted Govcrneneni Auditing Standards. Ihis course will emphasize the 
level of assmnee intended by the various lypa of otgagements and provi^ guidance on 
auditor indepcttdence, pUniting, fraud risk, level of testing, supervision, auditor 
judgment, a^ documentoion, and ttportini. All DCAA employees have been notified 
that they wiP he requited to lake this course in FY 2010. DC^A is also incrensing the 
level arid complexity of OAGAStraioing in all courses. 

RECOMMENDATTON 13 ; TheOAOrecommendsthat the Secretary of Defcose direct 
the Uitder Secieuty ofDefense fComptrollerA^FO) to require the Director of the DCAA 
to conduci a oenpeebensiv*, indepeixleTit review of DCAA’s revised audit quality 
assurance finction. Hus review should focuson ibecortsisteittapplication^cntuiB 
used for assessing audit quality and assuring timely, consistent and appropiaie reporting 
of review results. 

POD RESPONSE : Concur. On July 30. 2009, DCAA requested the DoDfO to perform 
its extemal quality review of DCAA’s Qualiiy Control System for oudits and anestaiion 
engagements for (he period ending September 30. 2009. 
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RECOMMENDATION 14 : 'Htt GAO recommends that (be Secretory of Detnse direcf 
iIk Under Secretary orDefense (Cosptioller/CFO) to require the Director of the EXDAA 
to m Ac approprisre recomotendations to address annual qualiiy assurance review 
findings of serious deficiencies and GAGAS noncompliance, provide training, and 
follow-up to assure th« appropriate conecljve actions have been taken. 

POP RESPONSE : Concm. The DCAA Integrity and Quality Assumce orgaoizatioa 
has already esiabiisbed a poceM for making iccomsoendatiwu to ^diesa annual quality 
assurance review findings of serious deficiencies and GAGAS noncompliance to (Ik 
D irector DCAA on a real-time basis. Based on these reconunendarions, DCAA will 
ensure that any necessary mining is provided and approiuitte corrective Ktions have 
been taken. 

RECOhWB^ATlON 15 : The GAO recommends that the Seoetwy of Defense direct 
the Under Secretary of Defense (Comptrofier/CFO) to require the Director of the DCAA 
to establish policies and ptocedures to ensure thM auditon who make direct bill decisions 
are independent <rf^ man^ereent employees who review vouchen of contractors not 
eligible for the direa bill program, thereby reducing simatioRS where DCAA auditors are 
encouraged to reduce their workload by approving contr«nots for the direct bill propam. 

POD RESPWSE : Nonconcur. The DepsnmentbcLievca that a review of the 
contractor's irueriia ptfoiic vouchers is an integral function of DCAA’s coniiDual 
assessment of a coatranor’s billing system. A DCAA auditor who audiu the contractor’s 
billing system (and potesti^ subsequent approval for direci bill) is in the best poriiion to 
review aitd approve contract interim billiitgs based on ihcrr thorough uitdentandmg of the 

contractor’s system. In regards m the CAO concern that DCAA auditors may not report 
findings to reduce their wwkjoad by approving contracton for the direct bill program, the 
Deparnoent believes (he CAO's coocmns are mitigated based on the com{Hehen$tve 
supervisory and audit managn reviews. DCAA does not believe that dK approval of 
interim vouchen along with the a^xoval for conireciors to be on direct bill resulu in a 
lack of auditor ob^vity (see Encfosure 4. Comment 8). It should also be noted that 
since My 2008, the ounkwr of ctminctors on ibe direct trill ptogiam hove bent reduced 
by over 200 contractors attd segmenu of many of the Wgasi defense coMraciots have 
been removed from the direct bill peogrro irr FY 2000. lit October 2008, DCAA issued 
clarifying guidance on contractor eligibility tn parikipate in the direci bill program. Thh 
memorandum includes gmdaoce on eosuriog sufficient testing is performed when 
determiiung a contractor is riigiMe for direct bill. 
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GAO DRAFT REPORT DATED JULY 31. 20W 
GAO-09^68 (GAO CODE I9S099) 


“DCAA AUDITS: WIDESPREAD PR(»LEMS WITH AUDIT QUALITY 
REQUIRE SIGNIFICANT REFORM"* 

DEPARTMENT OF DEFQ4SE COMMB<ITS 
TO THE GAO RECOMMENDATIONS FOR CONGRESSIONAL CONSIDERATION 

RECOMMENDATION I : fat the shoit tenn, as DCAA makes progress in correctiiig 
AndainentaJ weaknesses thsi hive impaded nidil quslity. Cco^ress could coaader 
enhancing DCAA refoim eflbrts by enacting iegislatioo lo gram it iioteclioiis wd 
authorides siotiiar to those embodied in the Injector General Act, as amended 

IVtn OP- ^PQNSE : Nonconcur. DoD genenlly reposes providing DCAA with 
authorities simiUr to those contained in the laspedor Gcstenl Act DoD ^ecifieally 
opposes certain recomroeMiations baaed on the 10 model. We do not believe that the 
DCAA Director should be a Senate confumed positioo unless DCAA is independent of 
DoD. Presidaitial nomination and Senate coofinnalioD iigecB a political element into 
DCAA that is not ^tpropriaie and inevitably creates lengthy paiods when there U no 
Difcstor. We also oppose fixed icnns for 1^ DCAA Director. If DCAA remains part of 
DoD, the Setretary of Defense must have the ability lo choose an ^pe^mate Director. 
We also ifiiesiion (he wisdom of an indepernlQit bu^t (which would ptevern or limit our 
ability to move money into DCAA. as is occunu^ now based on fouling from the 
Defied Acquisition Workforce DevelopnttH Fuad). Nor do we sun»rt mandtfory 
public pqrarting, an addhioaaJ burden on an agency that is already straggling to nwel its 
many mission demands. 

While we do not suppoit it^kpendence based on the 10 model, we plan to lake steps to 
strengthen OCAA's independence by establishing an appeals process Ihit pennits DCAA 
(0 seek resolution when there are differences of opinim a» lo ibe lesoiubon of its audit 
findings. Under (his process. DCAA could ajigeal diffoences first to the Direclor of 
Defense Procwemeoi end Acquisition Policy pFAR). If DCAA disagreed with ibe 
DPAP decision. DCAA would be pemiitied to appeal to the Under Secretaries of 
Acquisition. Technology, and Logistics md CornpUoUer, acting as a team. We expect 
(hat appeals al the Under Secretary level would be rare and would involvs only the most 
important issues. 


. ... In (he medufm term. Congress could craskter elevBting the 

contract audit function within DOD by movir* DCAA from laider the DOD 
ComptroUec/CFO and placing it under Ibe Deputy Secretary of Defense. 


DOD RE SPONSE : Nonconcur. DoD strongly opposes this reconunutdation. The 
Deputy Secretary is tbc Chief Management Offlea- of one of the world’s largest 
organizauoru and backs up the Secretary in (he wartime chain of command. The Deputy 
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DCAA Actioai Talua Sine* the iUBSiice of GAO Report GAO-9S-8S7 

Simctarc 

• Approved Agency-wide reduction in supervisn^ span of control (June 2008). 

• Approved 25 new field audit offices and 5 new Regional Audit Managers lowering the 
spaa of control (May - February 2009). 

• Completed Agency-wide staffing assessment and requested staffing increase to 
Comptrolhr on S^Meraber 10. 2008. Updates on saffii^ shortfalls were provickd to the 
CompiroRff at legular iMervals throughout FY 2009. 

• Realigned (Quality Assurance to report directly to the Deputy Director (August 200S) 

o Submitted teqiKst to OSD for SESies^posilKm for (he Inregtity and Quality 

Asumce (QA) hincaon (S ep tember 2008). Request wu initially denied by 

Drf> in January 2009 and the poshiDo was filled at the GS- 1 5 levd. However, 

atks imiher auempl by the Direeior for a SES position, DCAA received approval 
tn July 2009 and a Job announ ce ment was isued shortly thereafin. 
c Ejqraoded the next round c>fQ A reviews, 
o Revised proccM for tracking and follovnng-up on QA findrags. 

0 Revised process for next J-year cycle to ctsute all audit offices are covered, afler 
coeulHian widi the DoD lO. 
o Completed assessment oit level of QA staffing, 
o IsaKdrcvisedcompehensiveinsOucUDnonDCAA'sQAprognmfDecnnber 
2008). 

• Submitttd request for funds under SectK» 852 acqwsitionwiHUhtce fund in December 

2008. Under the Defense Acquisilioa Workforce Oevetopmera Fund, DCAA he 
received %M2 million to date (aHoonents in Mareh. April, and August). 

o DCAA brou^t oiv-boaM 245 new intens by ttre e^ of July and have many oilers 
widb ofr-board dates in late FY 2009. As a result, DCAA will easily meet the goal 
oflOO by the end of September and will probably exceed il. 

• Realigned all FtasKiai Liaison Advisors from the Field Detachment region (region that 
hoodies aH Secret audits) to Headquaners to avoid the af^arance of a iKk of 
ijiAp « tid»ee. A* orNown^ 300g, alt Fioarteial Liaison Advisors repoK directly to 
Headquarters. 

• At the request of the Director, the DCAA point of cootact for the Office ofSpectal 
Counsel investigation was moved from the DCAA General Counsel id the OoD Ocnenl 
Counsel's office due to the invesngauon being expanded. 

CriRurc 

• Revised policy for resolving differesces in audit results and opinions - elevate wrthin 
managemmt structure from two to four levels (July 2008). 

• Ceased participaUon as members of Integrated Product Teams (iPTs) to avoid the 
appearance of a lack of independence (August 2008). 

• Revised poformatce meaaires - eliminate 1 8 meaauies and 8 measures 
(Septembre 2008> 


Enclosiffe J 
Page I of 4 


Page 125 


GAO-OS-ddS DCAA Audit Environment 


13:37 Apr 18, 2011 Jkt 053841 


PO 00000 Frm 00267 Fmt6601 


Sfmt 6601 


P:\DOCS\53841.TXT SAFFAIRS 


PsN: PAT 




264 


Appendix IV: Conunents front the Department 
of Defense 


> Establidted an anonymous website fw employees to voice concerns with the 

inappropriate tne of perfonnance measures and other inappro|wiBte actions {September 
2008). 

• Engaged 0PM to conduct an organizational assessment survey and are assessing results 
of the survey conducted by OPM — the working g^up is evaluaiing results and 
developing actions (assessntent due August 2009). 

• CeasedpurticipationasineinbetsofSoutceSelectionEvaluatiooBoardstoavoidtbe 
appennee of a lack of independence - requested audits will still be provided (November 
2008). 

• Directot/Depuiy Director sufTprescittadonsemphauze the need to pofwmqudity audits 
and discuss performance measures (various presenialiotts through 2008 and 2009). 

• Established a Senior Advisory Council for Iraprovemenl chaired by die EHrector to 
oversee the imptementation of improveinents as a result of the Defense Business Board 
recotnamidMions (report issued January 22. 2009). 

• Issued several maao ran dums reiterating the imponance of cooperating with GAO, IG 
and other reviewera^vesiigaum. 

• Held stand down day for audit quality at all DC AA locaiicns (August /September 2008 
and again in August 2009). 

« Completed annua! independence training (September 2008). 

• Held focus groups to o^n feedback on implementaiioo of p^oimance measures issued 
in September 2001 which revealed minimal problems with imptementation of new 
measuKs (Febtuvy^larch 2009). 

• The Director required all regions to assess wMiher exceeding budget hows on individual 
assignmeius was napprt^aiely used u> lower p er for mance ratings. The regions 
completed the assessments and, where needed, have unplmented corrective actions 
(December 200^. 

• Established new process to obtain iofmi regarding the new hw employmeiii experience 
and to identify reasons why employees leave DCAA (November 2008). 

• Revised job obieetives^erfonnance plana for the 05 11 (audiior) positions lo eliminate the 
language on cacedtig audit budget bows and produetivi^ measures and added language 
ttrengtbening the need to execute audits in accordanee with the auditing standards and 
Agency policy (Febrxtary 2009). 

• RevM supervisory devetopmcnl curriculum based on feedback from focus groups and 
other foedtuKk mechanisms to emphasize leadership skills arid the more common day*lo> 
day achvfoes whkb supeivisore p^orm (April 2009). 

Processes 

« IssuedmeinoraQdumonBdcqustewoifcjagpaperdocuinentation{July2008). 

« Completed Agency-wide assessment to detennine whether Q AO’s findings are systemic 
across DCAA. Six of dx forty assignments reviewed cooiained noncompliances. 

Actions being taken to address issues (September 2008). 

• Raised the field audit office signature authority for all audit reports to the level of the 
manager or higher (August 2008X 
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• Revised policy for the monihly quality icviewofissued audit rqwrts from regions to ihe 
Headquarters Quality Assutance division (October 2008). 

• Revised DCAA Quality Checklist for Review of Audit Working Pliers (ebecklHi is used 
by auditors and sipovisors prior to repoH bsuance) (Deconber 2008}. 

• ItW* /«t»T»<yiwg TW**A A«« pipuwwg anA 

iniliatnig a subpoena (December 20M>. 

• Issued elacifyiiig ^lidaace on what cooslindes a significant deficiency in contractor 
imenial c<mtnd q'Steim (De ce mber 2008). 

• Revised policy on rqiontng results of the review of conoactor systems and relaied 
imroal conliols (o eliminate the inadeqiMe in-pan opinkm so that the overal! opinion on 
(he system is either adequate m inadequie (De ce mber 200SX 

• Issued guidance on perfbonu^ and lepoet ing on limited scope inlemal control audits 
(Oecembes 2008). 

• Issued guidance reminhng auditors to ttpon suspected contractor fraud and other 
areguteritiea encountered during the audit and emphasized that managers do not approve 
(he Form 2000. but rather review it for clwity (February 2009). 

« Issued guidance on documentation of jut^menlal sampling (Febniaiy 2009). 

• Revised guidattce for reponingunsaiisfaaory conditions related to actions of 
Govontneru officials wherein cenain unmitfactoty condiiioiu will be reported direclJy 
Id the DoDIQ in lieu of reporting the conditioiu to a higher level of managcnKni 
(March 2009). 

• Issued guidance clarifyii^TtquiremeRtsIbr contractor eligibility ID paiticipate in the 
direct bill program (Afiril 20(9). 

• Issued guidance to rctnove m^oe contnoon from direct billing where contractor has 
im^enieaied a new billing synero or acootading system (hat significantly impacts 
Ouv e mmeot billings and the new system bas not been examined (April 2009). 

• Revised a self-study !raiiungcoune(CMTl 1326) to include new guidance Oft 
tdeotiQring key efoments of an efiectivc iatemal cootrol awlit lepott and tbe requirements 
for issuing a r^-time (Oish) repon (May 2009). 

• Issued an audit alert emphasizing existing guidance which requires that a separate cost 
accountirig standards (CAS) noncompitance audit repoit will be issued when s CAS 
nomompliance is found during any audit (Jwie 2009). 

« Issued an audit alen to clarify (hat forward pricing due dates should be based on the 
reuUstic assessmmt of risk foclors for each specific coatractor and proposal under review 
(luiie2C09). 

• Issued guidance on contract audit closing sutemenl reviews in July (after receipt of OoO 
10 coovnents). This conmteies the last action item from the peer review. 

Long-Term Plaoned Actieaa 

« Obtanied the services of the Naval Postgraduate School, Center for Defense Management 
Rcfonn to assist with the Agency-wide cidtwal transformation. Tbe initiaJ effort started 
June 7 * widt the DCAA exeewive (earn. As a result, four major initiatives were adopted 
for incorporation in tbe DCAA Strategic RaiL Teams of executives were assigned to 
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each initiative to fiiilhcr dcvdi^ (he milestone plan for executing the objective. The four 
items are: 

t. How can DCAA put people first to guide its decisions, actions and values? For 
example, how can DCAA place an increased emphasis on “soft skills” such as 
building morale and developing employees (in terms of a broad understanding as well 
as technical proliciotcy)? 

2. How can DCAA deveh^ leaders to serve the employees and the organization? 

3. How can DCAA structure the organization to facilitate compliance with GAGAS, 
maximize audit rcsuhs/ROI, and better align Agency worUoad/resources? 

4. How can DCAA kkotily and resolve differing stakeholder expectations with 
contracting oflicen, contractors, the public (Congress), and exlema] review 
organizations? 

These items will be worked for about the next three years. Once the milestone plan for 
each of (he four iniliatiwes is developed, U is envisioned that each objective will have 
various completed actions (fatoughout the next three years. Once the milestone plans are 
developed, the ot^eciives will be communicated to the workforce. 

• Performing a comprehensive assessmeot and revision to DCAA training by instiiuting a 
life*cycle training process. ElToit started in FY 2008 and will conclude in about three 
years. 

• Conducting a comprebcnsivtoTganiational assessment (based on Baidrige). Estimated 
completion in FY 2010. 

• Performing a comprabensive review of DCAA’s approach for performing internal control 
audits. Estimated GonpledtHi of baseline audit opinions in FY 2010- 

« Engaging the Army Force Management Support Agency to evaluate DCAA's process for 
planning FY 2010 atidit needs as well as string requirements. The effort is expected to 
be completed by the end of September. 
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See comment 1. 


GAO DRAFT REPORT DATED JULY 31, 2009 
CACM)9^68 (GAO CODE 195099) 


"DCAA AUDITS: WIDESPREAD PROBLEMS WITH AUDIT QUALITY 
REQUIRE SIGNIFICANT REFORM” 

DEPARTMENT OF DEFENSE COMMENTS 
TO THE GAO REPORT NARRATIVE 


I - 0-AO NARRATIVE : Nationwide audit quality problems are rooted in DCAA's poor 
management environmem (page 1 1). 

POD COMMENTS : GAO stated ^u( half of the teseinded reports relate to unsupported 
opiniorks on conuactor tniemal controls This is iiwoncct. The majority of the rescinded repons 
relate to forward pricing reports based on the prior GAO investigation report issiwd in 2008. 

2- Gao NARRATIVE : Audit Quality Problems Found in All Audits GAO Reviewed. 
Independence Issues (page 12). 

DOD.CQMMENTS : GAO stated that in 8 audits they reviewed, DCAA independence was 
compromised because auditots provided material nonaudit services to a contractor they later 
audited; expenenced access to records problems that woe not fully resolved; or significantly 
delayed report issuance in order to allow the concracton to resolve cited deficiencies. The 
Department understands the OAO’s concerns, however, we believe the auditors' intent of 
providing preliminary audit results and discussing draft policies and procedures was generally an 
aaempi to ensure the evidence was accurate and to expedite contractor actions so that contractor 
systems would be corrected promptly to minimiie the risk of overpayments. DCAA 
acknowledges that significam lime lapsed in several of these assignments between the time the 
contractor was ^ovided the draft findings and the issuance of the final audit report. DCAA 
concurs that auAtors should not provide input to contractors on draft policies and procedures and 
that the reports should identify all deficiencies found even ibough they have been eerreeted at the 
time of report issuance. In memorandums issued in August and September 2CM>8, DCAA issued 
guidance prohibiting euditCHs from providing injroi to conlnctors on such items as draft 
proposals, draft policies and procedures, sitd draft disclosure stoiemenis and to raquire auditors 
to report all deficiencies found even when the eomraetor corrects the deficiencies during the 
audit. 

3' GAO NA RRATIVE : Audit Quality Problems Found in All Audits QAO Reviewed, 
Insufiicient Evidence (page 12). 

DQD .COMMENTS : GAO stated that 33 of the 37 internal control audits did not include 
sufficient testing to support audilm- coiKlusiom and opinions. GAO stated that GAGAS ftw 
examination-level aneststion engagements require that sufficient evidence be obtained to provide 
a reasonable basis for the coikIusiob that is expressed in the report. Wc agree with GAO that in 
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See comment 2. 


See comments. 


See comment 4. 


several cases the testing was insufficient. The level of testing was based on the auditor’s 
judgment and the total audit coocefH • drawing on an accumulation of knowledge and experience 
previously gained at the contractor based on auditing that contractor on a continual b»is. 
Nevertheless, DCAA acknowledges the testing was insufficient to stipporl an internal omlrol 
audit opinion, and therefore, has rescinded several of these reports, increased the level of testing 
on related audits and commenced new full scope internal control audits at these locations. 

4. GAO NARRATIVE : Tabk 2, Summary of Five Selected Interna] Control Audits, Eastern 
Region -- Bitting System Audit ( 5 >age 16). 

POD COMMENTS : GAO slated that the subject audit had an impairment to auditor 
independence because the auditors helped the contractor develop policies aiul procedures. We 
generally concur with (he OAO in that the FAO was performing IPT type effort in providing the 
contractor comments on draft policies and procedures. DCAA believes the intent of these 
actions was to expedite comracior cMtcctive action so that the contractor’s system would be 
corrected to minioiize the risk of overpayments aitd protect the taxpayer's interests. DCAA 
recognized (he potential appearance of a lack of independence related to this kind ofenbrt and 
on August i >, 2008, issued audit guidance that prohibited auditors from providing topui to 
contractors on such items as draft policies and procedures regardless of the circumstances. 

5. GAO NARRATIVE : Tabk 2, Summary of Five Selected Internal Control Audits. Central 
Region • Billing System Audit (page 16). 

POP COMMENTS : QAO stated that the subject audit had an impairment to auditor 
independence because the audiioR monitored comnetor corrective action for 7 months instead of 
issuing the audit report when the work was completed. DCAA concurs with the OAO that the 
significaffi lapse of time from the dale the drah resuhs were provided to the eoniracior and the 
date the audit report was issued gives the appearance of a lac^ of independence. However, the 
field audit office does not believe it intentionally delayed the isauance of the report to allow the 
contractor to correct the system. Staffing issues and an increase in higher risk sssignments 
played a significant role in the delay. 

6. GAO NARRATIVE : Table 2. Summary of Five Selected Internal Control Audits. Central 
Region* Billing System Audit (page 16/1^. 

POP COMMENTS : The GAO narrative appears to imply that DCAA was not aggressive in 
pursuing (he potential fraud at (his contractor. It should be noted that the DCAA Investigative 
Suppon Team was instrumental in assisting in this fraud investigation that resulted in recovering 
more than S2.6 luillion doliars in a civil case settlement. 

7. GAO NARRATIVE : Cost Related Arsignroenis (page 17). 

POD COMMENTS : GAO slated that the 32 cost-related assignments did not contain sufficient 
testing to provide reasonable assurance that overpayments and tailing errors that might have 
occurred were identified. It appears that the GAO is holding DCAA to the GAGAS 
requirements for these assignments even though the mqjorily is not GAGAS-type audits based on 
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See page 76. 


Agency policy. DCAA does nol agree that all of the 32 cost-related assignments contained 
insufTicienl testing, howevo-. DCAA is continuing to assess the GAO’s comments and will 
develop an appropriate action pi»t. 

GaQ NARRATIVE : AudiUH objectivity issues (page 20). 

POD COMMENTS : GAO stated that DCAA's role in approving contractors for participation in 
the direct bill program presented an impaiiment to auditor objectivity' which includes being 
indepertdent in fact and appearance when providing audit and attestation mgagements. The 
GAO noted that GAGAS state that audit organirations should not authorize an entity’s 
transactions or audit their own work. GAO further stated that DCAA’s role in authorizing 
contractors to participate in the direct bill program places it in tbe position of making decisions 
that impact its own workload related to Rview of contractor invoices prior to payment. 

Although not explicitly stated, the GAO seems to imply that w4)en DCAA peifocms an audit of 
the contractor's billing system (and potentially ^proves the contractor for the direct bill 
program) wihile also having the re^wnsibility for approving interim vouchers, DCAA is 
aiuhorizing the contractor’s transactions and it is auditing its own work. In ad(htion, the GAO 
seems to imply that DCAA’s objectivity is impaiied and DCAA auditors may overlook findings 
to reduce their workload by approving contractors for the direct bill program. DCAA disagrees 
with both implications. 

DCAA is noi authorizing a ccudractor's transaction or auditing its own work either when 
it approves the coniraclw for direct bill or approves an interim voucher for payment. GAGAS 
3.i4 (GAO03-d73C) defines authorizing an entity’s trarrsactions as an example of pexfoiming 
management furKtions or making management decisions. When DCAA approves a contractor’s 
voucher for payment it is nol acting on behalf of the contractor (i.e.. performing a contractor 
management furKtton) but acting as a leprtsenialive of the Government in iu role as an 
itideperKknt external oversight organization based on the authority provided for in DFARS 
242.803. The contractor’s interim vouchers submitted to the Government for payment are 
prepared by contractor employees seid authorized by contractor management. 

DCAA also does not believe that perfoiming the function of an exterrtaj oversight 
organization by approving contiactor’s interim vouchers or approving the conoaclor for the 
direct bill program places DCAA in the position of auditing its own work when it later audits the 
contractor’s billing system. These iunctions do not involve developing the contractor’s billing 
system policies and procedures and internal controls. In addition, as stated above, DCAA also is 
not involved in preparing the coniraclor’s vouchers. Therefore, approving contractor's interim 
vouchers or approving the coniiaclor for the direct bill program and subsequently auditing (he 
contractor's billing system does not result in DCAA auditing its own work. Punheimore, DCAA 
believes that its role in reviewing and ^rproving interim vouchers falls within tbe category of 
nonaudit services discussed in GAGAS A3.02 and A3.03 (CAO'07-73IG) that do not impair 
independence. 

We also disagree that DCAA's role in authorizing contractors to participate in the direct 
bill program results in an impairment to independence because performing that functioo places 
DCAA in the positiort of making decisions that impact its own workload. In our opinion the 
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GAGAS independence standants do not preclude the auditor from perfoming such functions, in 
fact, conclusions reached in many of the audits and other functions typically performed by 
auditors have the potential to Hopacl the audit organization's workload. For example, a qualified 
or adverse opinion on (he company's financial statements could prompt the company to replace 
the independent public accountard (IP A) that performed the audit; thereby negatively impacting 
the IPA's future workload aitd revenue. The GAO’s concerns are mitigated by the fact that 
DCAA siqKrvisors are actively involved in all aspects of the audit iiKluding review and ^^va! 
of the risk assessment, interim reviews as needed, and a final comprehensive supervisory review 
of the working papers and draft report. Technical specialists may also review the risk assessment 
and audit coiKlusion. In addition, field audit offtcc managers review sensitive aixl high risk 
audits and may elevate them for legiooai management review prior to report issumce. 

GAO staled that DCAA had appoved ditect billing on all but 2 of the 16 contractors they 
reviewed. GAO reviewed 20 billing system audits covering 17 contractors, only 2 of those 
contractors are still on ditect billing. It should abo be noted that since July 200B, the number of 
contractors on the direct bill pio^am have been reduced by over 200 contractors. 

9. GAO NARRATIVE : DCAA's audit quality assurance program was ineffective (page 2S). 

S 00 0306 73 POD COMMENTS : GAO stated that DCAA'S audit quality assurance pogrem was not 

^ properly implemented, resulting in an ineffective quality control process that accepted audits 

with significant deficiencies arrd noncompliance with GAGAS and DCAA policy. We do not 
agree with the siaieoient that the quality assurance process accepted audits with significant 
deficiencies. As the GAO states in its report, the quality assurance reviews did identify 
significant GAOAS noncompliances wdtich they reported to the field audit office for cotreetive 
action - they did not “accept” these audits. DCAA has recently made several improvements to 
the quality assurance program to include increasing the level of maruigement responsible for 
developing and implertteniing a corrective action plan. The current program requires the 
Regional Director to ensure eoneaive actiorts have been taken and all corrective actions will be 
tested by the Headquarters quality assurance staff to ensure (he noncompltances have been 
corrected. 

10. GAP NARRATIVE : DCAA lacks a risk-based audit platming approach (page 28). 

Sbg paQO 75. POD COMMENTS : GAO stated that DCAA lacks a risk-based audit planning approach. We 

do not agree with this siaiement. DCAA has a risk-based contract audit approach in identifying 
resource tequirements. DCAA perforros annual audit requirements planning procedures to 
establish staffing requirements based on its regulatory/statutoiy audit requiremeMs and audit 
risk. 

11. GAO NARRATIVE : Allegations about abusive management actions have continued (page 
32). 

POD COMMENTS : The GAO stales (hat allegations about abusive management actions have 
continued. The report ftather states that “DCAA Headquarters officials explained that in several 
cases. Western Region msn^ement has not agreed to l^e disciplinary or other available 
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See comment 6. 


See comment 3. 


cwrccttve action. The oflktals k^d lU that DCAA hotline stafT has no recouree in these 
situations.” The DCAA hotline group hmctions as a finder of fact, and they recommend 
corrective actions. While it is true that the DCAA hoUine group has no authoriQ' to take 
disciplinary action itself or to reqaire corrective action, any disagreement between the hotline 
team and the region may be resolved by the DCAA Director or Deputy Director. The Western 
Region management has agreed with the recommended actions provided by the hotline team in a 
fiital formal report. Several cases are still in the investigative stage and although interim 
recommendations may not have been adopted yet the region, we fully expect the Western 
Region management to suppon the teconunendations made in a final report. 

1 2. GAO NARRATIVE; Increase authority and independence (Page 50). 

POD COMMENTS : CAO Slated that legislation could strengthen DCAA 's audit authority by 
providing the same level of access k> iccotdi and personnel available to IGs. GAO goes on to 
stale that currently, DCAA has access to certain records related to cost-type contracts or that 
contain cosi and pricing data, biM not to contractor personnel. We do not agree with the 
statement that DCAA does not have access to contractor personnel. DCAA interfaces with 
contractor employees during alt phases of the audit, which include interviews, inquiry, 
observation as well as providing draft audit results for comment and verification of factual 
content. 

13. GAO NARRATIVE : Independence Impainnents. (Pages 60-d1). 

POD COMMENTS ; The GAO provides an example in this namtive section where the GAO 
contends that the field audit ofTicc experienced an access to records issue. The GAO eoncludea 
that since the contractor inquired regarding the auditor's need for certain data, there was an 
access to records issue. DCAA routinely encounters “push back” from connactors, this does not 
constitute an access to records impairment if the auditor does not succumb to the pressure and 
obtains the requested data. The Arid audit office does not believe its access to data relating to 
the training records was denied by the contractor as cited by the OAO. The contractor 
subsequently provided (he requested data to the auditor. 

14. OAO NARRATIVE : Failure to Design and Parfomt Procedures 10 Delect Fraud Risk 
(Pages 64-d6). 

POD COMMENTS : The OAO provides an example in this narrative section where the OAO 
contends the FAO manager and supovisor ordered an auditor to ignore signifKant fraud risks 
during (he audit. DCAA does not agree with this conclusion and has not been provided evidence 
(0 support this assertion. It should lx rtoted that (he DCAA was instnimeniai in assisting in this 
fraud investigation (hat resulted in lecovering more than S2.S million dollars in a civil case 
setdement. 
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Defense Procuremeni and Acquisition Policy (DPAP) 

Cotiatend Action Otficer’s Comments oq GaO Draft Report; 

"DCAA Audtis: Widespread Problems ii'ii ft Audit Quality Require Signijicant Reform" 


Fallowing ere the DPAP‘s Collateral Action OfTicer's (CAO's) technical 
comments regarding the Govcmment Accountability Oflice’s (GAO's) July 31, 2009 
Draft Repon GAO-09-468 (GAO Code 195099) “DCAA Audits: Widespread Problems 
WKh Audit Quali^ Require Significant Reform”. 

t. AudMog (D the Pubtie Interest 

The report, in part, inqHjgns DCAA’s audits stating, “DCAA's management 
environment ... p«r DCAi4 in the role of facilitating DoD contracting -without also 
protecting the public interest.'’* Likewise, the GAO mentions that the “DCAA mission 
should be refocused to protect the taxpayer interest ...“compared to the current mission 
that “fostered the culture of supporting contractirtg officials As a result, the GAO 
agrees with (he Defetue Business Board's recDmtnertdallon to “revise DCAA's misaon to 
focus on protecting the iiMcrest of taxpayeis, with the taxpayer as the primary customer 

The repon adopts a position that because DCAA is serving (be inteiests of 
Contracting Officers, (bat IXAA is not auditing in the interest of (he public. DCAA is a 
service organizatirm created to provide financial informaiion, audits, and advice to 
support decision makit^ by DoD CnraracUng Officeis. DCAA serves the public interest 
by providing timely and useful informaiion to Contracting Officers. It is erroneous to 
imply that contracting officers do not seek to protect the public interest. 

The coniroeting officer is bound by regulation to meet the public interest in the 
broadest sense, for the entire mtuter surrounding a contract. The contmiiDg officer, in 
the award and administration of a coniroct, is the jOvenuDcnl olTiciaJ responsible for 
insuring that all requirements of law, executive orders, regulations, and all other 
applicable procedures, ittcludmg clearances and approvals, have been met. Any logic (hat 
presumes that by focusing on supporting coniracling officials DCAA somehow failed to 
act in (be public interest is flaw<^ in our view. Someone irairted and named in both law 
artd regulation has to look at the larger picture, and not just the audit, if (he public interest 
is to be served— ‘Che contracting officer is that person. 

Numerous provisions of the Federal Acquisition Regulations (PAR), for instance, 
speak to the issue of members of the acquisition and administration community 

serving the public interest: 


‘ ExcMlivt Summary 
’ P»|« }4 
’ IBID 
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An essential consideration in evay aspect of the System is maintaining (he 
public’s trust. Not only must the System have integrity, but the actions of 
each member of the Team must reject integrity, fairness, and openness. 

The foundation of integrity within the System is a competent, experienced, 
and welt-trained, professional wortcforce. Accordingly, each member of 
the Team is responsible and accaunlable for the wise use of public 
resources as as acting in a manner which maintains the public's 
trust. Fairness and openness require open communication among team 
members, internal andcxtemal customers, and the public. * 

Specifically to contracting ofTicers, FAR states: 

Contracting officeis ate responsible for ensuring perfonnance of all 
necessary actions for effective contracting, ensuring compliance with the 
terms of the contract, and safeguarding the interests of the United States in 
its coniractual relationships. In order to perform these responsibilities, 
contracting officers should be allowed wide latitude to exercise business 
judgment. ^ 

By serving the interests of Contracting OfTicers well. DCAA does serve the public 
interest. It is not one or (he other as night be interpreted in the report. 

2. ProduetkiB Auditing 

Throughout the report, the CAO implies and in some instances states that the 
problem is “Production-Oriented Auditing” and that audits have been rushed by 
contracting officer requirements. This sets up a dichotomy between “quality” audits and 
timely audits. We strongly urge the OAO to consider that an audit not delivered in time 
to be useful, is of Umiled value to the Government. 

For example, a proposal review delivered after negotiation has started and 
decisions have already been made is of greatly diminished usefulness. Likewise, an 
incurred cost review that is not completed in a reasonable period after the costs are 
incurred loses contemporaneous st^iport — employees of (he contractor and the 
Government leave, some records are lost or are placed in deep storage. Similarly, 
business system reviews need te be issued white a problem is still subject to correction 
before the fact to protect the Government's inlereris, not two and three years later. 

Timeliness is a criileal element of quality. Delays in award have consequences to 
(he warfighter Contracting officers are required to consider those consequences and 
hence, they are very concerned that DCAA has not been able to consistently deliver 


'Far l.iO}-}(cX>)P<rf<>nn*>x« nandardi 
’ FAR 1.602-3 Respensibilities 
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timely reports and advice. The GAO has previously recognized there are consequences to 
award delays;^ 

** Although federal regulations do not specify how long (he contract award 
process should take, the regulations slate that (he purpose of planning die 
contract award process is to ensure that the govemmeot obtains (he needed 
goods or services in the inosl effective, economical, and timely manner. 

ThereftKe, wriflen plans for carrying out the award process must include 
milestones for completing (he steps in the process, such as when the agency 
plans to solicit and evaluate proposals and rntdee (he award. Developing and 
adhering to these schedtdes can help ensure that (he department conducts 
the process eflickitUy and can help companies make infMmed business 
deciskms regarding the allocation of their resources and whether to 
compete foraconowet” 

“Delays in awarding coiumcts could increase costs... and could also affect 
the willingness ofeon^ranies to compete for future... contracts.... 

SpecifKally. in addition to investing time and resouices in developing 
proposals, once a company submits a proposal. . . the company is generally 
required to ensure (hat the key personnel identified in the proposal 
continue to be available until the decision is made and the contract 
awarded. ...Increased costs and the length of lime it takes.. .to award a 
contract also have the ptuential to affect competition for hmire. . . work.” 

GAO’s recognitkmoflhis fact in the afoiemenboned report, while important, is 
still a comparatively limited view of timeliness compared to a contracting officer’s point 
of view. A contractirtg oGficet knows (hat delays can impact funding decisions and 
disrupt program management plans. Contracts are often interrelated and codependent, 
such that a delay in av^arding one contract can delay an entire system and put off fielding 
dates, with consequerKcs distributed and cascading through a range of other contracts and 
plans, and might ultimately result in mission failure. The contracting officer, also by 
regulation, has to consider and respect the opinions of other specialists (hat he works 
with, and not Just that of (be auditor. A good audit in time is better than an extraordinary 
audit (hat is late and never used. An aodil is a tool the contracting officer uses to 
negotiate and administer a contract, but in order to realize the btawfits of the auditor's 
work, the audit must be timely. 

3. Generally Accepted Govwnmcal Anditiog Standnrds (GAGAS) 

As the GAOcorreetty points out. DCAA perfomu most of its audits and reviews 
in confonnance with GAGAS. We believe that for some reviews and financial advice 
provided by DCAA, it is possible that it may not be necessary to provide a folly 
conforming GAGAS audit report to support certain contracting officer functions (e.g.. 


* CAO-0d-7]2. DOE CWTRACTINC, Bener Perfcnuncc Measures and Management Needed to Address 
Delays in Awardeig Comnets. June 2006 
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See comment 9. 


See page 74. 


See page 75. 


providing an aflestation levicw rather than a financial audit). DCAA should use auditing 
standards and techniques that produce creditable information that can be relied upon by 
the contracting community in the awarding and adminisiratii^ of contracts. However, we 
believe that all types of DCAA leporu aod reviews should be examined to deieimine if 
the standard being applied and reported by DCAA is the appropriate standard given the 
requirement causing (be audit or review to be performed. 

4. Staffing 

While Ihe report cites examples of poor quality audits and some poor decisions 
made by DCAA management, most would seem to be heavily influenced by lack of 
adequate staffing. Based on our discussions with contracting officers, contractors, and 
auditors, some and possibly most of the reductions in audit scope and responsiveness by 
DCAA is a direct result of the sttfTmg drawdown while workload increased. Until the 
staffing issues are resolved, it will noi be possible for DCAA to perform at the level of 
quality and efficiency that is desired. Rebuilding the DCAA workforce, while a challenge, 
can and must be done. The workforce build'up will require years of effort to hire and train 
the staff required to do the work envisioned by the GAO audit. 

5. PUeement of DCAA inthc Execntive Brnnch 

The report raises the question of DCAA ’s placement within DoD or the Executive 
Branch. Currently DCAA performs most of the contract auditing functions within the 
Executive Branch. Even if DCAA performed the remaining contract audits it currently is 
not performing, DoD would remain by a large factor the majority user of the DCAA 
services. We do not believe that any useful purpose would be served by moving DCAA 
outside OoD. DoD has the most vested interests in a vrefl functioning DCAA. 

In our view, in reporting to the Compuolter, DCAA is insulated froin direct 
influence from contract procurement and contract administration offices. For similar 
reasons DCMA is in the AT&L chain of command to insulate it from pressures it might 
have placed on it. if it were in the same chain of command as the procurement offices. 

The Comptroller is in the best position to understand the DCAA requiremenu while 
maintaining its independence from dte audit report users. 

6. Rbk Based Auditing 

According to the DCAA Contract Audit Manual', all audit planning is risk based. 
This applies to both the annual platuiing for types of audits and staff requirements as well 
as for the planning of specific audits. The Audit Manual is quite clear that the final 
budget set for the assignment is to be based on the ciicumstarKes and risk attached to the 
assignment being planned. Further, it also clearly sets out that as circumstances change 
or the risk is found to be differeol than considered during the planning stage, that budget 
changes .should be made. 


^ChtpW 3 , Seclran 100 
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We are faced in (he GAO repoit with the finding that budgeted hotns do not 
reflect the risk and (hat changed risk found during the field work has not resulted in 
changed budgets. This is obviousty not a policy matter of DCAA not doing risk-based 
auditing, nncc the fittings are cieariy at odds with the DCAA policy. We believe that 
thefailure to follow the policy is a result of siafTtng constraints that msle it impossible 
for DCAA to perform ait the assigned review requirements to the standards expecied. 

7. Direct BtUiag 

This GAO draft report seems to misunderstand (he Direct Billing program and the 
problems noted in DCAA administration of voucher reviews. Direct Billing approval was 
not designed to reduce review of vouchers, it was designed to administratively take 
advantage of technology to better process vouchers in an efftcient manner and to better 
comply with the Prompt Payment Act. In appropriate circumstances using ride-based 
analysis of contractor past performance and the quality of its business systems, conttactors 
were to be allowed to be paid before review of vouchers instead of requiring review of the 
vouchers before payment. 

The nature of (he review program for any given contractor shcnild not have 
changed due to placemcttl on Direct Billing. The DCAA guidance requires voucher 
reviews of aj) contractors every year that the contractor has Direct Billing authority. 

Where DCAA believed based on past performaiKe or poor systems that there was a 
significant chartce of improper billing, the contractor was not to be included in the Direct 
Billing program. The review (Rogram for the contractors should have been the same as it 
would have been based on risk factors even if there was no Direct Billing program. 

The problem with voucher reviews both before the Direct Billing program and 
after (he initiation of the program is that DCAA did not have sufficient staff to perform 
the reviews required by (he risk-based analysis. New contractors and problem contractors 
should have voucher reviews before payment just as required by DCAA policy. 
Establidied contractors with adequate past pc^imance should have vouchers reviewed 
after payirteni using a reasonable plan tailored to the contractor's circumstances jtst as 
required by DCAA guidance. Changing the decision authority for participation in Direct 
Billing should have no impact on what vouchers are reviewed. Taking a contractor off of 
the program does not ensiae (hat the vouchere will be properly reviewed prior to payment 
if there is not sufficteot staff to perfontn the reviews. 
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The following are GAO’s comments on the U.S. Department of Defense 
letter dated September 4, 2009. 


GAO Comments 


1. Rescinded reports. DOD stated that we were incorrect in stating that 
about half of the rescinded reports relate to unsupported internal control 
reports. DOD is correct. Of the 80 rescinded audit reports, 24 (31 percent) 
relate to unsupported opinions on contractor internal controls, 47 (61 
percent) relate to forward pricing reports, and 6 (8 percent) relate to 
defective pricing, compliance with cost accounting standards, and a labor 
floor check. We have corrected this information in the body of our report. 

2. Central Region billing system audit. DOD stated that the DCAA field 
audit office does not beUeve that it intentionally delayed issuance of the 
report to allow the contractor to correct the system. Audit documentation 
clearly shows that the auditors monitored the contractor’s actions for 7 
months and issued the audit report 9 months after the exit conference, 
once the contractor had prepared “written desk procedures to ensure 
liquidation progress billings would be handled correctly.” Opinions should 
be based on the finding zt the end of the audit, and reports should be 
issued when the audit is completed. 

3. Central Region billing system audit daring f^aud investigation. 
DOD stated that our report appears to imply that DCAA was not aggressive 
in pursuing the potential fraud at this contractor and noted that the DCAA 
Investigative Support Team was instrumental in assisting in the fraud 
investigation that recovered over $2.8 million in a civil case settlement. 

The audit documentation shows that the Regional Audit Manager, in the 
presence of the field office manager and the supervisory auditor, directed 
the auditor not to pursue contractor charges of costs to future-year, 
unfunded contract lines and to forget what she learned in her previous 
DOD contract administration job where she had been responsible for 
reviewing similar types of contracts. In addition, after reassignment of the 
first supervisor, the second supervisory auditor instructed the auditor to 
stop “over documenting” her audit, to complete the assignment, and issue 
the report. Moreover, the DCAA auditors who investigated the fraud 
worked with the Army Criminal Investigative Division special agent and 
Department of Justice Attorneys, not the DCAA field audit office. Finally, 
we did, in fact, discuss additional documentation we received from the 
investigative auditors with DCAA headquarters officials and provided 
them a summary of the key audit-related issues that we obtained from the 
investigators. 
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4. Insufficient testing in cost-related assignments. DOD stated that it 
appears that GAO is holding DCAA to the GAGAS requirements for these 
assignments even though the majority of these audits are not GAGAS-type 
audits. As discussed in our report, DCAA does not consider its paid 
voucher reviews and overpayment assignments to be GAGAS assignments. 
However, this is important work intended to assure the reliability of 
contract payments. Specifically, DCAA paid voucher reviews are relied on 
for making billions of dollars in continuing contract payments without 
prior review by the government The Defense Finance and Accounting 
Service (DFAS) relies on DCAA voucher reviews, and DFAS certifying 
officers do not repeat review procedures they believe were performed by 
DCAA. Because paid voucher reviews constitute a payment audit, they 
require sufficient testing to support reported DCAA conclusions that the 
government can rely on contractor controls over preparation of interim 
vouchers to continue to make contract payments without prior review. In 
addition, DCAA’s overpayment audits are intended to determine whetlier 
the contractor has adequate controls in place to detect and correct causes 
of overpayments and billing errors and make timely refunds and 
adjustments. The limited testing we observed in our work does not 
provide the intended assurance. 

5. Increase authority and independence. DOD stated that it did not 
agree with our statement that DCAA does not have access to contractor 
personnel The discussion in our report is based on DCAA’s authority in 10 
U.S.C. 2313(a)(B)(2), which gives DCAA legal access to certain contractor 
records but not access to contractor personnel. Further, DCAA subpoena 
authority in 10 U.S.C. 2313(b) is specific to the production of contractor 
records that DCAA is authorized to audit or examine and does not cover 
contractor personnel. We agree that in practice, DCAA auditors have 
numerous ongoing discussions with contractor personnel However, if a 
contractor official refuses to talk to an auditor, DCAA does not have legal 
authority to compel contractor officials to meet with or talk to DCAA 
auditors. Our point is that under authority similar to the IG Act, DCAA’s 
authority to interview contractor officials would be enhanced. 

6. Independence impairments. DOD stated that DCAA routinely 
encounters “push back” from contractors and that the DCAA field office 
subsequently received training records from the contractor. We recognize 
that the field office received some training records from the contractor. 
However, we saw a pattern throughout this audit where the auditor limited 
requests for contractor documentation and also performed little or no 
testing in various areas because “the contractor would not £^preciate it” if 
he did more testing. The audit documentation shows that the auditor 
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performed limited testing of selected billing clerk training. Additionally, 
documentation on testing of the contractor’s review of subcontractor 
costs shows that although the auditor should have tested cost data for 
three of the top five subcontractors, the auditor asked the contractor to 
“provide a list of the top 3-5 subcontracts, including subcontract values.... 
Three subcontractors would be fine." This indicates that the auditor not 
only accepted data the contractor was willing to provide for testing, but he 
also let the contractor select the data to be used for testing. The auditor 
then tested costs of only one subcontractor. The pattern of backing off on 
requests for documentation and limiting the extent of testing based on 
concerns about the contractor's reaction indicates that the auditor was 
influenced by the contractor and limited his audit procedures as a result — 
a clear independence impairment. DCAA rescinded the audit report on 
February 10, 2009. 

7. Production auditing. USD AT&L comments suggest that there is a 
trade-off between audit timeliness and audit quality. We view both quality 
and timeliness as critical to effective contracting officer decision making. 
However, timely audits that do not meet professional standards are not 
quality audits and could be misleading or impair important contract 
decisions. For example, our audit identified three contractor internal 
control audits — an accounting system audit and two billing system 
audits — that were completed in 9, 13, and 15 days, respectively — all with 
adequate opinions on the contractor’s internal controls. Apparently, the 
contracting officers involved thought these audits were timely and met 
their needs because there was no audit documentation to the contrary. 
However, in response to our work, DCAA has rescinded all three of these 
audits. USD AT&L comments also stated, “A good audit in time is better 
than an extraordinary audit that is late and never used." Our report did not 
call for extraordinary audits. DOD has determined that certain DCAA 
audits should compfy mih professional standards. When audit 
organizations state that their audits comply with professional standards, 
they must follow these standards. Further, until DCAA and AT&L address 
the need for DCAA to perform 30,000 assigrunents and issue over 20,000 
reports annually, DCAA will continue to face audit quality and timeliness 
problems. 

S. Contract audits in conformance with GAGAS. USD AT&L states 
that it believes that for some reviews and financial advice provided by 
DCAA, it is possible that it may not be necessary to perform GAGAS work 
to support certain contracting officer functions. We agree. As discussed in 
our report, a risk-based audit approach may require an appropriate 
delegation of nonaudit contract administration activities and audit 
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responsibilities among DCMA, buying commands, finance community, and 
DCAA. An effective risk-based approach would include an effort by these 
communities to re-evaluate whether all such services should be provided 
as audits and whether DCAA, as an independent audit organization, would 
perform any nonaudit services. 

USD AT&L also stated that DCAA may be able to support contracting 
officer functions through an attestation review rather than a financial 
audit. However, DCAA does not perform financial audits. Instead, DCAA 
performs examination-level attestation audits and reports conclusions and 
opiruons on subject matter as a whole. Examinations provide the highest 
level of assurance, and they must be based on sufficient evidence, often 
referred to as positive assurance work. For an attestation review, GAGAS 
require auditors to perform sufficient testing to form a conclusion based 
on the work performed. It is important to note that GAGAS prohibit 
auditors from performing review-level attestation work for reporting on 
internal control or compliance with laws and regulations. 

9. DCAA staffing. USD AT&L stated that “the [DCAA] workforce build-up 
will require years of effort to hire and train the staff required to do the 
work envisioned by the GAO audit." We did not call for a build-up of the 
DCAA workforce. Instead, we noted that DCAA production metrics had a 
direct Impact on audit quality. Therefore, it will be important to perform a 
risk-based analysis of FAK requirements and determine the mix of audit 
and nonaudit services that will best meet these requirements with 
consideration of appropriate roles and responsibilities of the contracting 
and finance communities. 
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(NSPECTOR GENERAL 
DEPARTMENT OP DEFENSE 
400 AAMV NAVY DHIVe 
Am-mOTON. VIROINIA 22202-47M 


Gregory D. Kutz 
Managing Director 

Forensic Audits and Special Investigations 
Government Accountability Office 
441 G Street, NW 
Washington, DC 20548 

Re: OAO DraA Report, "DCAA AUDITS: Widespread Problems with Audit Quality 
Require Significant Refonn;' dated /uly 31. 2009 (GAO Code I9S099/GAO-09-468) 

Dear Mr. Kutz: 

Thank you for the opportunity to respond to the subject draft report. We recognize the 
critical role that Che Defense Contract Audit Agency (DCAA) plays in contractor oversight 
inside and outside the Deparanent of Defense, and we take very seriously concerns about 
compliance with generally accepted government auditing standards (GAGAS) by DoD audit 
organizations, 

Our narrative response to ycair recommendations ate included at Enclosure I , As an 
alternative to the recommendation that this ollice rescind or modify our May 2007 Extecnal 
Review of the DCAA Quality Control System opinion report, we instead notified DCAA on 
August 24, 2009, that our May 2007 '‘adhM)uaie” opinion on the DCAA system of quality 
control would expire on August 26, 2009 (See Enclosure 2). On the basis of our action, 
DCAA has begun to qualify its GAOAS-compJiant audits with a statement noting an 
exception to compliance with the Quality Control and Assurance Standard. In addition, it 
was recommended (hat E>CAA publicly disclose the concerns of your office to include 
questioning the reliability of audit reports issued during the period covered by our May 2007 
opinion. Our August 24, 2009, memorandum to the DCAA will be made public upon the 
rdease of your report. 

Please contact Ms. Carolyn R. Davis at (703) 604>8877 if you have any questions. 
Sincerely, 


Gordon S. Heddeii 

Enclosures; 

As stated 
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GAO DRAFT RH*ORT DATED JULY 3 1, 2009 
GAO-09-468(GAO CODE I9S099) 


"DCAA AUDITS: WIDESPREAD PROBLEMS WITH AUDIT QUALITY REQUIRE 
SIGNIFICANT REFORM*' 

DEPARTMENT OF DEFENSE INSPECTOR GENERAL COMMENTS 
TO THE GAO RECOMMENDATIONS 


RECQMMF-NDATinN 1 : The GAO recommends that the Department of Defense 
Inspector General (DoD IG) rectmsider its overall conclusions in the May 2007 DoD IQ 
report on the audit of DCAA's^piality control system in which it reported an adequate 
(“clean”) opinion on DCAA system of quality control in light ofthe serious dcfictenctes 
and findings included in thatrepmi and the additional evidoice identified in our audit. 
(Page 57/QAO Draft Report) 

DQDIG RESPONSE : Concur. 

RFQDMM^NDATION 2 : The GAO recommends that the Department of Defense 
Inspector General based on the above, determine whether the report should be rescinded 
or modified. (Page 57/GAO Draft Report) 

DQDIG RESPONSE : Nonconcur. In reference to your recommendation that we 
rescind or modify our May 2007 External Review of the DCAA Quality Control System 
opinion report, w« have taken an alternative action that conforms to the intent of your 
recommendations. The DoD IG has taken the extraordinary action of notifying ^AA 
that our “adequate” opinion on DCAA 'a aystem of quality control as detailed in the 
May 2007 External Review ofthe Defense Contract Audit Agency (DCAA) Quality 
Control System report will expire as of August 26, 2009 (See Enclosure 2). 

Our action recognizes that our May 2007 report was based upon a quality review 
methodology that differed substantially IVom your audit, but acknowledges that additional 
concerns about DCAA qualiQ' controls must be addressed. On August S, 2009, we 
anrraunced a project under the tide “Evaluation of the Defense Contract Audit Agency 
Quality Assurance Program” (Project No. D2009-DIPO AC-0283). The results of this 
evaluation will be used in formulating our next opinion on the DCAA external quality 
control system for the period ending September 30, 2009. The overall opinion will take 


Bnciosure ! 
Page 1 of2 
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into consideration repeated non-compliances with Government Auditing Standards 
identified in our May 2007 and December 2003 opinion repeats on the DCA A quality 
control system. By not rescinding our May 2007 report, we can also use the rep^t 
deficiencies in formulating our next opinion. 

Placing an expiration date on the opinion means that after August 26. 2009. DCAA 
will be (grating without an opinion on its system of quality controi. We have 
recommended to the Director. DCAA. that her agency immediately begin to qualify its 
GAGAS'Compliant audits with a modified GAGAS statement noting an exception to 
compliance with the Quality Control and Assurance Standard. Additionally, we have 
recommended that DCAA publicly disclose on its officlai website your concerns, 
including the questioning of the reliability of audit reports issued during the period 
covered by this office’s May 2007 opinion. 

Our May 2007 report and the OAO July 2009 draft report focused on the period 
ended September 30. 2006. I believe it is paramount that we move forward and critically 
analyze the existing DCAA environment, its organizational effectiveness, and the quality 
of its recent audit wtxk. Given the critical mission of DCAA. we plan to focus our 
attention and resources on a current analysis to yield real-time effective recommendations 
(o improve DCAA audit quality. 


Enclosure i 
Page 2 of 2 
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IN^CTOIt GENERAL 
OEPARTMENT OF DEFENSE 
400 ARMY NAVY DRIVE 
ARLPIOTON. VIRQINiA 22202*4704 


AUG 2 4 2003 


MEMORANDUM FOR DIRECTOR, DEFENSE CONTRACT AUDIT AGENCY 

SUBJECT: Review of the Defense Ccmtracl Audit Agency Quality Control Syslem (OIG 
Report No. 0-2007*6-006) and GAO Draft Report, “DCAA Audits: 
Widespread Problems with Audit Quality Require Significant Reform” 
{QAO-OM68) 

Our May 2007 External Review of the Defense Contract Audit Agency (DCAA) 
Quality Control System provided DCAA with an adequate opinion on its internal qual!^ 
control system while still idenliiying significant audit quality problems. However, our 
significant findings in 2007 coupled with the results of the July 2009 Government 
Accountability Office (GAO) draft report, “DCAA Audits: Widespread Problems with 
Audit QualiQ' Require Significant Reform” (OAO-09-468), necessitatesthatwetake 
further action. We have determined (hat it is not prudent to allow the adequate opinion 
from our May 2007 report to carry forward. Therefore, effective August 26, 2009, our 
adequate opinion will no longer apply to (he DCAA system of quality control and will 
require ftitther actions on your part. Specifically, we recommend the following be 
implemented immediatdy: 

1 . After August 26, 2009, all DCAA audits identified as being in compliance with 
generally accept^ government auditing standards (GAGAS) must be quBlified 
with a modified GAGAS statement noting an exception to compliance with the 
Quality Control and Assurance standard. 

2. DCAA should publicly disclose on the DCAA website OAO’s concerns regarding 
the reliability ofDCAA audit reports issued during the period covered by this 
office’s May 2007 opinion. 

As requested by your July 30, 2009, letter to my office, we have started preparing 
for the externa! quality control review ("peer review”) of DCAA for the p«iod ending 
September 30, 2009. Oi August S, 2009, we announced (bat project under the title 
“Evaluation of the Defense Contract Audit Agency Quality Assurance Program” (Project 
No. D2009-DIPOAC-0283.000). The results of this evaluation wii) be used in 
formulating our overall opinion of the DCAA quality control system. The overall 
opinion will also take into consideration repeated non-compliances with Government 
Auditing Standards identified in our May 2007 and December 2003 opinion reports on 
the DCAA quality control system. 
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TMs acliori is necessary to mainlain the integrity of this office’s oversight 
respcmsibilities for audits conducted by Department of Defense ageaeies. This 
memorandum is being distribuied to the recipients of our May 1, 2007, opinion report, 
and wifi be posted with the May 2007 opinion report on oar DoDIG website. 

Please cental me or Mr. Charles W. Beardaiiat(703) 602-1017 or 
Ms. Carolyn R. I^vis at (703) 604-8877 if you have any questions. 


Cordtm S. Heddeli 


cc: Under Secretary of Defense 

(ComptroUor)/Chief Finanoiet Officer 


Enciosuie 2 


(1950M) 
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